a9306fbd7de80e99cf3d09d680e70ab9aadaed7d68c126cc5b3f1bd35f2717e1

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17b3749e2c493a4f38256cbf9f9c6dae_JaffaCakes118.html
Size

39KB
MD5

17b3749e2c493a4f38256cbf9f9c6dae
SHA1

ccc86a236cb8169d5057654f81f1c331030ef5c8
SHA256

a9306fbd7de80e99cf3d09d680e70ab9aadaed7d68c126cc5b3f1bd35f2717e1
SHA512

5bf691e2d62918f3afdc3345dbf1db947076c590ccfaba94c255df02984c2131d99b0fe85caceae89beb57d13d0e021ecd3a41e6c62a2c53750cec3796b86060
SSDEEP

768:n3ZKxY4MJu6LALdFXM3jCsyXQrF4NvQGCCNxltPwG1/b5kR62Up:3ZpJu6LALdV8jCsyGF+xltPwG1/buR6f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
2848	msedge.exe
2848	msedge.exe
4852	identity_helper.exe
4852	identity_helper.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2156	2848	msedge.exe	83
PID 2848 wrote to memory of 2156	2848	msedge.exe	83
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3836	2848	msedge.exe	84
PID 2848 wrote to memory of 3404	2848	msedge.exe	85
PID 2848 wrote to memory of 3404	2848	msedge.exe	85
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86
PID 2848 wrote to memory of 2976	2848	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\17b3749e2c493a4f38256cbf9f9c6dae_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2df146f8,0x7ffa2df14708,0x7ffa2df14718
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4652596933789901456,8081621310005530260,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,4652596933789901456,8081621310005530260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,4652596933789901456,8081621310005530260,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4652596933789901456,8081621310005530260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4652596933789901456,8081621310005530260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,4652596933789901456,8081621310005530260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,4652596933789901456,8081621310005530260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4652596933789901456,8081621310005530260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4652596933789901456,8081621310005530260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4652596933789901456,8081621310005530260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4652596933789901456,8081621310005530260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4652596933789901456,8081621310005530260,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
752B

MD5
9a0e1ece18301b15ad8af7158c06746d

SHA1
309f2a17f9e2028d89df97e22598a2effd75c2a7

SHA256
5f40a4f290184526d6557ad5873c6ee05d16ed877da430a3e087d44d2c3ee95b

SHA512
bbd2c46c6b804179fae0d23b09368c66004816bdffd7a94e1029613292e5278f95917cab177a304414f910879b9d0f69329f0491b21fcd0ecd15c67f0b93bf5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e74356c549d3ff5242f5e0d2f9b1da1

SHA1
0a2ec8e5ac2370948692586384deabaa2ac601fb

SHA256
6138934f8d4a143b84e675817600e28a9639a2313f4036959c1893de3d9fc3c8

SHA512
68bbea8dc26054a73e9803e0d61fab9b2755cf2fdc041ef590ca48aff2858a4ba4fd0eeb96f3fa362dfcf9aba56888d1c324b9d78dd72009b5bcd587d118a499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9c6b5c133d789d3329340e04672cbab3

SHA1
37a910b4442c6adcf2ee9f430d8ebe6ee1c69674

SHA256
65001b78b27bcc12cc8206d5ce7943e57cad8253ea68bc4b7c6cdaf91f5cdf2a

SHA512
b3c617fb585cccf002ea55968dbced7dc944ae2ed9b5281ef59a54476beebb8072f7e16bd64a335eb2c1ee57b26606aff9c50e4d373525d0787562643591478f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6242ce4f2c29f122672c3369381948c1

SHA1
69f39075e95be38d10bbb7a72dcea5deb6976930

SHA256
4e4a46b2f91246d3f8e2d4de9be0c8fd76324b3dbc879b9d839536084a0a4af5

SHA512
f992c8f83541f53939b395e640927e09f7e20cdbeb58cc69250b67289aa3a43656e2d56bbb7b12c8844b172644e1f21777c02ba778232922216d8186d782b282

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bb6c16c74d6da0e888e8a20050bcf20d

SHA1
24879ab97e7f837a5edb9d0984bd1f1996faf9b5

SHA256
cb200e235fc52872b1272e6d7cc254880e006577f843b347178c13b65037de1e

SHA512
b5ed0cf1cd58431e2725fa61131c004804bb92c94887e764e9638e6657e7074a9a7251de7808534b9fb13df940ab9220e1d1de0036bc671085fd7e9779c100e1

Download Submit