cf23cae7515c05abfe72bc05b7303e9b9bc3a8d7b242de97db29d44c52a27edb

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fe7bfffa45c46a02dcd32da8894b4e3a_JaffaCakes118.html
Size

62KB
MD5

fe7bfffa45c46a02dcd32da8894b4e3a
SHA1

547c25ce74968e49bcc1cb82d2a007529c599c0b
SHA256

cf23cae7515c05abfe72bc05b7303e9b9bc3a8d7b242de97db29d44c52a27edb
SHA512

ba2c0c78fb4b83f8b7a5abba906fdf0a7ac8e1f878b2652012c748e5baf74ed1b27f43a070abe6f27cac0a5ceca0453155163b400736e8df238e6856d3978a41
SSDEEP

1536:WfIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7S71i:T1gYWl6e6o1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
4776	msedge.exe
4776	msedge.exe
3984	identity_helper.exe
3984	identity_helper.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 2328	4776	msedge.exe	86
PID 4776 wrote to memory of 2328	4776	msedge.exe	86
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 4360	4776	msedge.exe	87
PID 4776 wrote to memory of 3308	4776	msedge.exe	88
PID 4776 wrote to memory of 3308	4776	msedge.exe	88
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89
PID 4776 wrote to memory of 2596	4776	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fe7bfffa45c46a02dcd32da8894b4e3a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa73ff46f8,0x7ffa73ff4708,0x7ffa73ff4718
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,8944790819736899429,8722790685329144727,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,8944790819736899429,8722790685329144727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,8944790819736899429,8722790685329144727,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,8944790819736899429,8722790685329144727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,8944790819736899429,8722790685329144727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,8944790819736899429,8722790685329144727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,8944790819736899429,8722790685329144727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,8944790819736899429,8722790685329144727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,8944790819736899429,8722790685329144727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,8944790819736899429,8722790685329144727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,8944790819736899429,8722790685329144727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,8944790819736899429,8722790685329144727,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4940 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
379B

MD5
ed9895a7bdfe8729b68cadf7e00b7423

SHA1
3ed2149912bbaa0bb51ba7ec90d13e24a3e5cdb1

SHA256
c1a9288056d742ee10f11e3bfb4477c906b73fa23c6170ca32ec800ea30ba735

SHA512
9dda82d5398d97e2f6a6a79e843e79c6c50acc7e269f72ae9aa9efabcb27f3d9a304a515fc0cc97b60de289af2282a8fa59e94d0cb7f70c234c204fc4bc87ab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e06a1182f328b2f78349b1e04950c7a2

SHA1
f87f7ddfc336abffcb383f1f1a003ee43ff13aa4

SHA256
d748330de299a9a2cb7357a44ea3d194a351cd1ca8f512dc062ed3c214d7029a

SHA512
e29a0ba790d009cfa5881291b75db73a5cc5bbf8095f4f83fb4b8563b561d4f10d840d937c5aa9c419558468d9b29f21aa4cf8edd95385407eb137b4b7fc1a41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
413795b26e6333a6e0c780f8e35e7e02

SHA1
b07398d1cbec4e54bee78eaffa16182d46c0f2b0

SHA256
238ffa4b33ae52043d899a2bc4fe8f24d82135d492b88f44fa83e48b2938e52a

SHA512
8c61bced88b1d3e979e9cb73d33a9ccd9c229c7de5633aaad418a7fb37cd2695cff9238739432454fd6528f2f0de2ede0809448c6551c79ca689298ac0dcf7f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
785d012ce4fe89814a84f5557261f42f

SHA1
2f762064db312f3fc9623602319a8ea6c50a8ef0

SHA256
5237e2736da2d771074c79f7cc7d6ee7e007f4f66f285361b10163c469053bc0

SHA512
f922cf4f093e349be304f4544baed5b315edba7a9ade3329e40031f0832216b1a90a3c93f84d322ba53954a0e25c357fe02b04a952b7ce22d27d8024381f560d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b2818459b2e19b4f935df05619ee3d99

SHA1
81d04c7525f0887696f049e07a88c6970e522b29

SHA256
ad5e3b5a5ce7631dc49d82c6d791cb868fef1ea7180863de0190cb60d5816649

SHA512
c377d2a6649e75d2140a7103fc373ad55bdf97411ad1286a365603ad83ccf3e9231c39248ce1d6a75842813b596bd61bd1c37ada1edb66beb4edfa4686f1fe1b

Download Submit