65761529193eebb5aa743930e9e8f943b3ed1b1b82549c2978826dd2b26817a8

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03dccf7ac8255bd7de7d1218f094e1ce_JaffaCakes118.html
Size

202KB
MD5

03dccf7ac8255bd7de7d1218f094e1ce
SHA1

d282bd44b1eb56b25ee22bef17a98a872ae35e77
SHA256

65761529193eebb5aa743930e9e8f943b3ed1b1b82549c2978826dd2b26817a8
SHA512

85c5e8c2d936af94b947e10f400feac5850205545b43d8d2f6565fe0ccdac9a117bdc8c39cd162532da5f9d7cbb91d1d763c3625c74a9a271badf0eb3e8ae77e
SSDEEP

6144:/ntaA/RtQSUl53z7QWnEm9HRlltE0QumH:ftaA/Rt123z7QWnEm9HRlltE0QumH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
4768	msedge.exe
4768	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 968	4768	msedge.exe	85
PID 4768 wrote to memory of 968	4768	msedge.exe	85
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 2720	4768	msedge.exe	86
PID 4768 wrote to memory of 1724	4768	msedge.exe	87
PID 4768 wrote to memory of 1724	4768	msedge.exe	87
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88
PID 4768 wrote to memory of 1740	4768	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\03dccf7ac8255bd7de7d1218f094e1ce_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff873f446f8,0x7ff873f44708,0x7ff873f44718
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,14283564318900389841,11668052771868115685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,14283564318900389841,11668052771868115685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,14283564318900389841,11668052771868115685,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14283564318900389841,11668052771868115685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14283564318900389841,11668052771868115685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,14283564318900389841,11668052771868115685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4000 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,14283564318900389841,11668052771868115685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4000 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14283564318900389841,11668052771868115685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14283564318900389841,11668052771868115685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14283564318900389841,11668052771868115685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14283564318900389841,11668052771868115685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,14283564318900389841,11668052771868115685,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
43ea80a4e99b5be69d5431962f59306a

SHA1
cbc4894b6eb11c8f45ef983a920b2399b390e4df

SHA256
3a3427d418a452ff31a4e13310fbf56cb230051cb9322528f0f1b0466903284d

SHA512
58766e148a33f514037a089ccf49a9d3ec1d77b6a3989f8dac90068ae65a882d5ed8e262d7072e5fd450ee6257f156e8ddd9dbb9ed5ce68f4f82dd48b1a2fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
06f8014fe569500bd067dbb63e6e0cfc

SHA1
409b447d37215b009ad1ed95cfec1cef2b6a63c5

SHA256
b4aa4c01a73272aff707d4e574cd4df7d52e179ca9b22b4882b5ca832038934d

SHA512
52c13dc24f56b2ee592d7a772072a80d2fb4bb51c5ec8600ab3948fe1db5f4ecc477a8a75a7d9cd44b9fdc9c307309b1479707a7d5388a093b6486ad6157985e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
05118135ca305b7ebcc5fa0e44798908

SHA1
d6fda4b093edea9e7415060763a22a8c5c96b8c4

SHA256
121a3e157048a598258d691efb43e43b25b739c7e7124e23c37da2088ff95477

SHA512
de2dc5053505c18e2c8627ad669d4188e8e1d4651130d2e34680ccae61a8b887b1ee913039d5a32f767b2f16f04bc1bb95ccd50a5cab560505d2311a2eb403d8

Download Submit