14b3966e7745224b4e1af720283f3a1bdbae700f7f3383c41c91ccc6fa59d65e

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02d03a4f335d3ad6fe802a236d39db8a_JaffaCakes118.html
Size

348KB
MD5

02d03a4f335d3ad6fe802a236d39db8a
SHA1

54412278ae1e5dfbdac9b0492f89498d45826230
SHA256

14b3966e7745224b4e1af720283f3a1bdbae700f7f3383c41c91ccc6fa59d65e
SHA512

7cbf02ad807cb6407c6a775aa2be3bb821654424d56886d506cb8e5e5a3c8e12c2b674f24f7ea0154702682968f4a41266410802da55458fee3e5950809b01f5
SSDEEP

6144:ysMYod+X3oI+Yn86/U9jFijsMYod+X3oI+Yn86/U9jFiI:w5d+X3R8mU9jFm5d+X3R8mU9jFd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
4884	msedge.exe
4884	msedge.exe
4432	identity_helper.exe
4432	identity_helper.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 3420	4884	msedge.exe	85
PID 4884 wrote to memory of 3420	4884	msedge.exe	85
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3088	4884	msedge.exe	86
PID 4884 wrote to memory of 3116	4884	msedge.exe	87
PID 4884 wrote to memory of 3116	4884	msedge.exe	87
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88
PID 4884 wrote to memory of 5088	4884	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\02d03a4f335d3ad6fe802a236d39db8a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe726846f8,0x7ffe72684708,0x7ffe72684718
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,10890245257970561276,6461041961534910714,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,10890245257970561276,6461041961534910714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,10890245257970561276,6461041961534910714,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10890245257970561276,6461041961534910714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10890245257970561276,6461041961534910714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,10890245257970561276,6461041961534910714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,10890245257970561276,6461041961534910714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10890245257970561276,6461041961534910714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10890245257970561276,6461041961534910714,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10890245257970561276,6461041961534910714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10890245257970561276,6461041961534910714,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,10890245257970561276,6461041961534910714,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4572 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
892da73e67c1f4fb8180f7e8dff3ee42

SHA1
3463a81c0258e3f19171cc71bfed8ab9f9936da8

SHA256
393d35d10775e965ae09c3e376d400789f334712a3bdcae790ff25621e1f4357

SHA512
3a69cb55d7f5c339cd3a11582a9e4d8d67ad7f2d887bb98c67f1ff1ab51afbf2ec39377d34c512a56dd3dfbfadfdfcd1c925e7d5b684147f7e8197b098cb67c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04fdebec9b619483bae70a1797ec439b

SHA1
5f041814bf0db2b2a521eb93ceb53e1e06f838f5

SHA256
a11ebd9efac8593c53f732cee4f690d182d20deec07c0c2cfeba50feca5781cd

SHA512
d93acce77600262c0422ee4740e849f2a496a7ab0c675fcb810301f003156eb2d11c16ff8c9787bd4f846a26de770e79c8085a1eb7b3c6ef7a56a863a45f3eca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
c6c257fe8fe14cb79f9f86a2bf0ffba5

SHA1
d5af0133b94a4b01069a0dbf9ae445a21c6651dc

SHA256
3b1930710173e9ce3bb2c81414a15fede10a12770d3a1b3b78578f14887115c7

SHA512
ca1b82f80b2d6248995c573edc229a4caeeab11e250c6e16375936c7a88bcfa5de7604ee9149d2edff6443eb5be3e7e6822363cfc326051ed07c31efaf80e298

Download Submit