c74ba7bff5a7fce23c8bde9d1a33135d75083a27561fa35dd2cfa0fe4c0b68d7

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c76e460d9cd33d314cb9e2786211a91_JaffaCakes118.html
Size

27KB
MD5

0c76e460d9cd33d314cb9e2786211a91
SHA1

33791bd2b02f7a998320ab2201f8583f77c89827
SHA256

c74ba7bff5a7fce23c8bde9d1a33135d75083a27561fa35dd2cfa0fe4c0b68d7
SHA512

21e02c69378e55675727fbfd0fafb4dae8e56f6504aa4f7ab8cc444825ca9ff9fa4c0c03de5e47bded3d55d0e52fa4a40f43f07c316aab58088cc6af3ce4575d
SSDEEP

192:uwbwb5nZmnQjxn5Q/MnQieHNn7nQOkEnt4qnQTbnZnQ9evPm6unZnQl7MBnqnYn+:oQ/buxSZWSJmvh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
3916	msedge.exe
3916	msedge.exe
2876	identity_helper.exe
2876	identity_helper.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 2796	3916	msedge.exe	84
PID 3916 wrote to memory of 2796	3916	msedge.exe	84
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 1740	3916	msedge.exe	85
PID 3916 wrote to memory of 4448	3916	msedge.exe	86
PID 3916 wrote to memory of 4448	3916	msedge.exe	86
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87
PID 3916 wrote to memory of 1336	3916	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0c76e460d9cd33d314cb9e2786211a91_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe0af46f8,0x7fffe0af4708,0x7fffe0af4718
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17626677692082592435,14441564330294806461,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,17626677692082592435,14441564330294806461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,17626677692082592435,14441564330294806461,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17626677692082592435,14441564330294806461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17626677692082592435,14441564330294806461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17626677692082592435,14441564330294806461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17626677692082592435,14441564330294806461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17626677692082592435,14441564330294806461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17626677692082592435,14441564330294806461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17626677692082592435,14441564330294806461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17626677692082592435,14441564330294806461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17626677692082592435,14441564330294806461,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
936864c638d8a4d0cf4c79adbe826abc

SHA1
96a4366fd701a07c17895899eda6793702bd27df

SHA256
5ee897478e962939c1831fe38a47924da34bd0079efc8c0ed41ab17861ed442c

SHA512
a8e60fa52bf39ff781d810d05caec2df932fa3cfde3e5ef95f1b1b912f6b53e82bbf2273bab3e4a1b0782f0a3ff61aa10def4aa3b05faaf72c0c6c21bda4f0b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d78f6208f2aea8aba52b0c57e92eb032

SHA1
0ce2590e971cf4e1a6f777c0708dedf0bb2e138f

SHA256
45812a959e1b229e8f14160afd7347bc142e43f47cc2ca2387ef8a7a83092e2d

SHA512
d16871e161f4fb920347314f3c3a414cd11abaa0f56aa55853619508dcbbfd82e1a0286b679b5bc041746b4a25096d00aac2b1fee84c2baefb8e107e3882ec55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
752711df4f657014a8fe11b9fc5f0be7

SHA1
40e5893333c5c46abc34bb97c8c68bdc0176a459

SHA256
597309868362feb0a283704989bd0261e966cdf7c76634042d6bd173f0b37c23

SHA512
7009ed5a7635c2a1ebe097503980905e1d7d7fc0aa561c634e7363acc8f5016a259ef4f85d67ac8e490d911ab8c7ad1c25180ed3671f9c58e2fac8a674af2be8

Download Submit