fa5565fff5877f9a9960a5ae887ecd1f194df1fe44d1ab48e6735ff91c0eb149

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

13216e0273318c3c1bad17afce94bc9f_JaffaCakes118.html
Size

120KB
MD5

13216e0273318c3c1bad17afce94bc9f
SHA1

81e0b8d537b4e3455a4c7ef42dd8dba548f3f43e
SHA256

fa5565fff5877f9a9960a5ae887ecd1f194df1fe44d1ab48e6735ff91c0eb149
SHA512

e59067cf09c2a1e96b4b14a7080732d8870bc5c986aaee2a85871649b59d911add63af6ca4846207efa0ee5962db438ab7650bf14e716a07b957de62988da018
SSDEEP

1536:S7SHM8C14yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:SS84yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2440	msedge.exe
2440	msedge.exe
5020	identity_helper.exe
5020	identity_helper.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1964	2440	msedge.exe	83
PID 2440 wrote to memory of 1964	2440	msedge.exe	83
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2040	2440	msedge.exe	84
PID 2440 wrote to memory of 2256	2440	msedge.exe	85
PID 2440 wrote to memory of 2256	2440	msedge.exe	85
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86
PID 2440 wrote to memory of 4912	2440	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\13216e0273318c3c1bad17afce94bc9f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c02546f8,0x7ff9c0254708,0x7ff9c0254718
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,13630071228012760625,12696366193289215413,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,13630071228012760625,12696366193289215413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,13630071228012760625,12696366193289215413,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13630071228012760625,12696366193289215413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13630071228012760625,12696366193289215413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13630071228012760625,12696366193289215413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13630071228012760625,12696366193289215413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13630071228012760625,12696366193289215413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13630071228012760625,12696366193289215413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13630071228012760625,12696366193289215413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13630071228012760625,12696366193289215413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,13630071228012760625,12696366193289215413,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4944ccf9fa9a69161bc8cee0106b56fe

SHA1
409da6bf80df75618974f33b9eb7b6400be6bdda

SHA256
72f05420bff486ccdbd4c7d31a3cdec60ee7f9c424ff5a6f81ac2590f0a4c0f2

SHA512
92d904b5d2efae63a447286521a345a4f3232a91dc617c9f2a80eb44574c3227a2513339599e46e8cf7c5d135cee0802c388d0dc1d249630fd18df6d565d84d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ef04dac9691862a4eb83bf398cf0b119

SHA1
53ed38e46a8818cd5dde69781a60a229e59a2f47

SHA256
541d939a991447b5e063adc41f8990886d988c53b5c026e4264ebccec761e85d

SHA512
1ed94a2085bcf3ece55c6968518b684fa57a309e5471e78918ac5714c2f96631e43116e1531ec3ca4ac34b4c8bae51db645301b4298c5caf18bd25ea924f8e11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7cc75da15393cb821f15e0bfd7a1e53c

SHA1
6e45a666511a7e25a92663ee95357dca34f434eb

SHA256
6336ad47061fac096e4535eefa84892e4930a44619a4fa31b41ff21fd94c53b7

SHA512
545bd3b5b94303a3c02bfbfe0e0e23cfe2e99710ee292ac972274340ed8e6c78b48e6a56a856a697c9227a2b06bd1dace508a554cbebfee99299ccf1a70f78b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9fda2920a646e9bcb464dfd6808c6d96

SHA1
2644eb740001941d329791f1dff6e540c13c04b9

SHA256
bd2a6457ae8af4dc2720fc20af641a91d08a2eb91756db83fb5437740ba11906

SHA512
8876e25e314681aecfed58e29bb0ee07b10f8bf74299c32e73d154faef9d35c4af9c70e9633c8185c04bdca7630d8ceeef6f58791995013a3b187a3b20a88945

Download Submit