07493530a21f1b6e623278d814aaf20c9e949dc69e7b3d1ad177542669b9d7e9

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

039199ebf9396ac7a6897afc24ab0aa6_JaffaCakes118.html
Size

28KB
MD5

039199ebf9396ac7a6897afc24ab0aa6
SHA1

ab5f961ef3e4059ed4ec31d009ad8e7973485bb9
SHA256

07493530a21f1b6e623278d814aaf20c9e949dc69e7b3d1ad177542669b9d7e9
SHA512

57055bbd80e731e0b8684cceff3d372b3be6b937e79c6652570a557cfdf4f4e8d52686a530f39fb195e7dc76035c5a2ad6ee4326204c936d15f731ed1d2a845f
SSDEEP

192:uwDnq5ztb5nuhYanQjxn5Q/cnQiefNn/EInQOkEnt4qnQTbnZnQ9eH3m6//rKEta:Xq5zXQ/h7OpXrK5Sq

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2544	msedge.exe
2544	msedge.exe
1792	msedge.exe
1792	msedge.exe
4368	identity_helper.exe
4368	identity_helper.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 3944	1792	msedge.exe	84
PID 1792 wrote to memory of 3944	1792	msedge.exe	84
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 1608	1792	msedge.exe	85
PID 1792 wrote to memory of 2544	1792	msedge.exe	86
PID 1792 wrote to memory of 2544	1792	msedge.exe	86
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87
PID 1792 wrote to memory of 1648	1792	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\039199ebf9396ac7a6897afc24ab0aa6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff14d946f8,0x7fff14d94708,0x7fff14d94718
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,7189833099777349150,18185209870712183864,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,7189833099777349150,18185209870712183864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,7189833099777349150,18185209870712183864,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7189833099777349150,18185209870712183864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7189833099777349150,18185209870712183864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2116 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,7189833099777349150,18185209870712183864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,7189833099777349150,18185209870712183864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7189833099777349150,18185209870712183864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7189833099777349150,18185209870712183864,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7189833099777349150,18185209870712183864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7189833099777349150,18185209870712183864,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,7189833099777349150,18185209870712183864,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1364 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3aa1b4d69203f2bb77314a24ca20db9

SHA1
d70c99c47ebd721a61a2cfa732c96190cd393065

SHA256
708827ec56f58b01f0ed099b0ee89d88cbfba42fca0aba65a0b517f1f754eba8

SHA512
6053a78c4758976ddac7e07e619ad467cabb7ada2dd38304a640bebb35d4ad7125e666009cad19af8f94d6174eb88318757ee69bbcda7a1efb9817fcd9833e0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a324b1989d4cb44e7db9caa3b0d0d02f

SHA1
7ecbf5584079b8d474d24dbfa3a2f9b61fdb7aaf

SHA256
2b1f60ca5641ea18c51a86aa0b6ace9cebb75fbcc598c78fdb2a97f5df255779

SHA512
1b46e291195d62e03544def87935d996c4ad44c532cd80f2967da07fbcb226598b9d09a34a2e0e02dbccd25d18ca8ef1659ca760cc4a83a1866953dd92376668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
80b0f72045f890320b0d58389d349d3a

SHA1
7fe72073ec053648739a95a35d6b15f0295fc845

SHA256
6496eb96876c659e2ba632e5572d5498c7adcc7913fd6a934c51bfa04de59265

SHA512
08c5484ba0c64ded3952f23f5f4f889e3299690e286504cd53421146a3830bf23465b550b80589ec047e84ba76091088c8a86d96623e41f49f4f5f26421cdcb8

Download Submit