23ab2f4b7bc8ded58c1be3c41922395e6a6c0579709479f45316989dd24c9b87

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

017f73cbe0a4ac6bcf54ee7d855b4064_JaffaCakes118.html
Size

173KB
MD5

017f73cbe0a4ac6bcf54ee7d855b4064
SHA1

f1bbaf8d1dc1e2dc2e09442e04102c98949807bf
SHA256

23ab2f4b7bc8ded58c1be3c41922395e6a6c0579709479f45316989dd24c9b87
SHA512

5f54933e89f7bc83585c34a96ec4c69a1249bad81de2af5a829dd81d021db1f626a0e659cf05f9c2642d53d5a3b315a04e020792dbb7501213332dc7dfa1437d
SSDEEP

3072:SL4gXeKbDtMPCZxcjmUFCXs7vy+Prutb4yMz3kkMmFF4VbhJqmqDqyfkMY+BES06:ScgXeKbDtMPCZxcjmUFCXs7vy+Prutbi

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
4624	msedge.exe
4624	msedge.exe
4304	identity_helper.exe
4304	identity_helper.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 2208	4624	msedge.exe	84
PID 4624 wrote to memory of 2208	4624	msedge.exe	84
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 1472	4624	msedge.exe	85
PID 4624 wrote to memory of 920	4624	msedge.exe	86
PID 4624 wrote to memory of 920	4624	msedge.exe	86
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87
PID 4624 wrote to memory of 3020	4624	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\017f73cbe0a4ac6bcf54ee7d855b4064_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd837746f8,0x7ffd83774708,0x7ffd83774718
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12807306411452715076,2482000364741868967,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12807306411452715076,2482000364741868967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12807306411452715076,2482000364741868967,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12807306411452715076,2482000364741868967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12807306411452715076,2482000364741868967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12807306411452715076,2482000364741868967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12807306411452715076,2482000364741868967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12807306411452715076,2482000364741868967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12807306411452715076,2482000364741868967,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12807306411452715076,2482000364741868967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12807306411452715076,2482000364741868967,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12807306411452715076,2482000364741868967,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2604 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
02651d62fdf067c4273ec05b35735fb1

SHA1
1e4374f03082c417a6340e88aaf953f2263937ac

SHA256
cbe54dc7ccc4c368ce398ccf7e81f72bd459cd5d4a2941e8a8330298c9c98fd4

SHA512
fbea718033b6335480fbb689a6b52fea3d579713b13861e66e0f2fe52d207b2e828360d860bbf46b708afa5b1faa1ec4475417699b3b8d396a6b11ec697f6e6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b466f59b0f43163271af93097b779e1f

SHA1
a3dabde92fd752c4e6d665f6739b351b94afae55

SHA256
b3fc3eda3910f5c893ddd33b677c3c85607082795273618794978f4f47ba8f72

SHA512
7a3b25dac16d04d79fe9afd0f1e7d75ef9db94a557cbda40a2bcedef809749a25aca3118f5e0aab2601a7dcb65ae5582dcdc77ed5765815a3cdb28de04c47898

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d2d01b709eaaf35df27b99028d9c4c8b

SHA1
88085f58c7f01aab58357b3e0975444522eb4414

SHA256
89704627db9019c72050f6ac0371f255d0b014ac7ec992c2945e833f2a3c5aff

SHA512
0db8934c9c313b6f1a08335c50d1261c18a5f80441689e87a671be7fff31c9652eb9694dc4ddeee6193167ce9cbcc3af8cc00635991efc37b0ca3679e22f8422

Download Submit