e26ab8992fbaf22c7289eea26222465ec9e09b69d04fa8cee85708282195f959

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 11:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

127a24b40e3d1db9c9a063ddc7bfa2e3_JaffaCakes118.html
Size

74KB
MD5

127a24b40e3d1db9c9a063ddc7bfa2e3
SHA1

a37213b83c83967c2dddf790cdd8f5ac884e5779
SHA256

e26ab8992fbaf22c7289eea26222465ec9e09b69d04fa8cee85708282195f959
SHA512

91321effd6b0d6c81d2d371da6f4cdbe36d70d96f617c1701659f944ff55807238bd31b1415687bf43a298e7feb526cbad132a58fd7ab8ccbddf8f04d8557f16
SSDEEP

384:yQhuc6Pgj4NpBnaTcu714k3Nu3yqRaRsSZ9/XevHobGfL3xq3eTAr5qjdatrLVIw:yQhuc6IjEpBnqp/OnSZnjzwC7wuEu

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
3904	msedge.exe
3904	msedge.exe
4916	identity_helper.exe
4916	identity_helper.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 4136	3904	msedge.exe	84
PID 3904 wrote to memory of 4136	3904	msedge.exe	84
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4660	3904	msedge.exe	85
PID 3904 wrote to memory of 4376	3904	msedge.exe	86
PID 3904 wrote to memory of 4376	3904	msedge.exe	86
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87
PID 3904 wrote to memory of 4352	3904	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\127a24b40e3d1db9c9a063ddc7bfa2e3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac3a046f8,0x7ffac3a04708,0x7ffac3a04718
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,3101158043078595657,18000048976875494488,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,3101158043078595657,18000048976875494488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,3101158043078595657,18000048976875494488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3101158043078595657,18000048976875494488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3101158043078595657,18000048976875494488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,3101158043078595657,18000048976875494488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1828 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,3101158043078595657,18000048976875494488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3101158043078595657,18000048976875494488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3101158043078595657,18000048976875494488,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3101158043078595657,18000048976875494488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3101158043078595657,18000048976875494488,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,3101158043078595657,18000048976875494488,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
497B

MD5
0a5b6d532942db6894ebce63a16b55a1

SHA1
c6d3ba3d4027e9f68bf8c06cf168b04df551fee5

SHA256
28d54440de8c9b54e357590b9877b803cc7e817186cd2753ea8bfdc8d090c116

SHA512
f6b2e633f3230e63d33c60cd9ddafef50898df6d7f1cd448977628666e64e5d4d96070aaf3444e593778fc7c964eb92637cf430693e716878272a62a9781ce6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
72d67934158c7cd556de9b3dff87f1d6

SHA1
f42db67d0af7cbda4bc4c8d7159e856ff9ac3fd2

SHA256
14ee6af290953acd3cc643b6a678be9d318f16cfae9e62c171904b335475a3f2

SHA512
1d9209848f29325e2758e7c060f3e9cb3a48c0b963b35d50980ffdcee4c0560361d8d239755802ab6d6a879d120e1661eca63f2dd3a938c7e4b06eef1cae872a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8af251a6ee15dff72b7b802664090380

SHA1
07d9373853eb4f59a640230fa8927dc91c8d5101

SHA256
7a1659f20e25cd7b94e07ca3ac0d3f8f2487ae68def385943cdd2558c6b23ca3

SHA512
98ff25ebe97ed9ed10cedefdb3da17cef90c89903ddd932b1275cc53416b1e571f4693390723b3bca12c5f9a740a4b3526397a6606e849abcbb8b694766d1088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8153c380175d29933a0354652c47a819

SHA1
61bdf8ed47b3d8c6fea4b985662bd24f084fd41e

SHA256
8cfe84b0f916ff059d3ad9a057cd4bd2e9544a6bf3d9f4c875aab61d53271961

SHA512
065f9cd994c0c7d8b00825ff4451e9fde9670285773057f72a902f57875b433d4d771b06da78ef5e1261434079bbaf0ac5f434f79d65a57d528288845340f83d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d3fa91aea2668ea8839c5622c863312a

SHA1
427a09f88208dfca0300a952de3e5e5d56eb8904

SHA256
1e759c198a82e678a0671a28caae036157447a03e892f44bddbd2b42707d6eca

SHA512
87dde71af162bbbffef22eaaca91b92ad85935589302860b752ce5c6b2b4ccf58e68dce31b80d82a14fabf57ffea96d620757849f50e6ca9eb157c5a0e00c41a

Download Submit