61753c08f9ac3b85bcd36842f298c04a252e294d5bf7de6c47c56239812abea6

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d4fe788d134055c88746a903c2efb2b_JaffaCakes118.html
Size

23KB
MD5

0d4fe788d134055c88746a903c2efb2b
SHA1

f9b84037e7d5eae5c4f80da2b969f2a79393f3ee
SHA256

61753c08f9ac3b85bcd36842f298c04a252e294d5bf7de6c47c56239812abea6
SHA512

a1c1527ac8af7ab4fb5ecca8ede6bab3d083aff1d0a33e70f8bc59594af9aee328297d6ff2175facdb01f3fad752ca6e3a0b6ce2699df87abc655090504c4a12
SSDEEP

192:uWTMb5nGenQjxn5Q/JnQieUNn5nQOkEntPjnQTbnRnQ2CnQtGwMB0qnYnQ7tn+YW:XQ/VOnF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
316	msedge.exe
316	msedge.exe
212	msedge.exe
212	msedge.exe
2752	identity_helper.exe
2752	identity_helper.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 232	212	msedge.exe	84
PID 212 wrote to memory of 232	212	msedge.exe	84
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 2624	212	msedge.exe	85
PID 212 wrote to memory of 316	212	msedge.exe	86
PID 212 wrote to memory of 316	212	msedge.exe	86
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87
PID 212 wrote to memory of 4432	212	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0d4fe788d134055c88746a903c2efb2b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd37b946f8,0x7ffd37b94708,0x7ffd37b94718
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1414976898441176398,8672119658644752729,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,1414976898441176398,8672119658644752729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,1414976898441176398,8672119658644752729,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1414976898441176398,8672119658644752729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1414976898441176398,8672119658644752729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,1414976898441176398,8672119658644752729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,1414976898441176398,8672119658644752729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1414976898441176398,8672119658644752729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1414976898441176398,8672119658644752729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1414976898441176398,8672119658644752729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1414976898441176398,8672119658644752729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1414976898441176398,8672119658644752729,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a919810f19936d4f35496ccc035f319f

SHA1
da0431b0c71b02a88f216f495f6d7442a954e38b

SHA256
3571453b5a3a3d48d2c18fe1b30145352d5c5a3644c97ddf669328dce104be69

SHA512
afc23cf14c073e008bbaeaaa07937a6fcc726850cf8cc1d8c607405171341a1f948a7bc102451effc0c21623041c53223c052cb4e101f8e39f734d2b07b3d155

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6cfa72db9df93bce4493c604483cfe8a

SHA1
5a29ff468eb3da87d4af7d4a5e5739c35487841d

SHA256
15cd9a504cf3e98ed40f6fdfd51cd2fb11d9527ff4f440a209766799ccc28dca

SHA512
719ce4f823f888e662b3854d0e3cf6cff952f4df87ff88a5c1a05e1453541936290939fb0d65f42b091626b1bbbf920ed20dea6808b4a590b73f846ccf52ca48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
96dc3eb0b86c8e751cdfc868f72bfcab

SHA1
1e46551e30aea4a25da6186338a2ae4c4d7da52a

SHA256
383216c12f197870b8bcad7755508a5ab3f5d8cc1532424edca04f00f5a80d0c

SHA512
2301a68fc9d84326d11cf2506019eda720b3b613381f3c6281d89b69b675d83fa00c78d3ed8c5403349704b20c388a4b1e0f881519517f504b08872f392bc134

Download Submit