868ca4744f56f8070534580cc1cd219ba183167895bee7426e48b73fef1f3c28

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0497c902f0bf2e37a63c5073d81de66b_JaffaCakes118.html
Size

460KB
MD5

0497c902f0bf2e37a63c5073d81de66b
SHA1

2b3502e87d10c5eb3d80fc10d0711130a87d87b9
SHA256

868ca4744f56f8070534580cc1cd219ba183167895bee7426e48b73fef1f3c28
SHA512

149a0fe9e7f14fc44c1d655367d7297bb82a6026b752d7b37c5e6bfd29994b94c37296032b0f1545e1a0369480140b7ec1ad2f7703188a28b1720b98ffd376ce
SSDEEP

6144:SWsMYod+X3oI+YTsMYod+X3oI+YrsMYod+X3oI+YLsMYod+X3oI+YQ:v5d+X3R5d+X3l5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3200	msedge.exe
3200	msedge.exe
2204	identity_helper.exe
2204	identity_helper.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 1020	3200	msedge.exe	83
PID 3200 wrote to memory of 1020	3200	msedge.exe	83
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 2668	3200	msedge.exe	84
PID 3200 wrote to memory of 3480	3200	msedge.exe	85
PID 3200 wrote to memory of 3480	3200	msedge.exe	85
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0497c902f0bf2e37a63c5073d81de66b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef94246f8,0x7ffef9424708,0x7ffef9424718
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2470560546681733634,14642345974487147167,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,2470560546681733634,14642345974487147167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,2470560546681733634,14642345974487147167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2470560546681733634,14642345974487147167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2470560546681733634,14642345974487147167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2470560546681733634,14642345974487147167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2470560546681733634,14642345974487147167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2470560546681733634,14642345974487147167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2470560546681733634,14642345974487147167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2470560546681733634,14642345974487147167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2470560546681733634,14642345974487147167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2470560546681733634,14642345974487147167,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\11bbc672-35d7-4c66-9de1-b8e243fbac5b.tmp

Filesize
6KB

MD5
07ebb0e1eae8756d30f40273b355f79d

SHA1
6e47265c6f0a3ba529e0fbc4428334e84e85bd34

SHA256
95e6ebaeeee37cce394e405da02ffc7ea0f08331dc70344336f3a5cc1b30f789

SHA512
aaad9e59b5f5577e2926ed4903e99268ce607988a1af39247385f62184e4bb036c667cc552fce57cbb3e19e53b88c95009ce24e029a3c85dc8a25481e782c5b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
726c03b75ff6fe2984cc2217400de7ca

SHA1
faeef174955c01b30416fb45b3decba665d7f26a

SHA256
3a93e48089721ac0b8bc2f545030b26b8a973961096f81cdbeb59f1c495d4968

SHA512
5e85e9a0c4ba6696c255b34b95d9792adbd34829c8a9e7f8dc675764fff43df347a7b4053f855bbcf594708ae0c4161dd9febd06342ef4c019b09e976fd6d406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
b985ef6078b8982ba933f06bfccca8f5

SHA1
59b3db9e3315cd9d37d2d7f68c39f25729e6899a

SHA256
5d5068a7f9c0c7104f3bd7135921e73ecc2f3fc6d05f995a565cabc3a99082ce

SHA512
12b45391e6aa635e6fa5fbfb0e0d4ea0faa3e9d8ecbdc515982d3b54948161e33530273222d8cc5a62748c756db9e9443fa6d83b39b009b316ce8fdcfe4de0ae

Download Submit