6d33ee9449f8adf6d8477a275fcd0d8afddf6a00fe46d1b106b442dda4f75b67

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18127526c0e3d1e1686820863f8e8d9d_JaffaCakes118.html
Size

12KB
MD5

18127526c0e3d1e1686820863f8e8d9d
SHA1

d2873e9d1a26441a9412a67a1eefd5962d87d830
SHA256

6d33ee9449f8adf6d8477a275fcd0d8afddf6a00fe46d1b106b442dda4f75b67
SHA512

f013ebecc71603ff73f4056d23a75b62e8a5cdcbdb0ed80658af6e9ef3d41dac3b7ff7a03e1a2154c989db6385b07f09ca29a656804e9f0ec10c96a9ab6d6774
SSDEEP

384:OJ94VawIla8R5+ADbYvZN9nyltMRPcjIP+bMcuSxx7TB:OP4kba8R5+OEklZ8P+boSp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4960	msedge.exe
4960	msedge.exe
3048	identity_helper.exe
3048	identity_helper.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 3032	4960	msedge.exe	83
PID 4960 wrote to memory of 3032	4960	msedge.exe	83
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4964	4960	msedge.exe	84
PID 4960 wrote to memory of 4476	4960	msedge.exe	85
PID 4960 wrote to memory of 4476	4960	msedge.exe	85
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86
PID 4960 wrote to memory of 4696	4960	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\18127526c0e3d1e1686820863f8e8d9d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc966f46f8,0x7ffc966f4708,0x7ffc966f4718
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18247673768624689009,1388219240718370503,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,18247673768624689009,1388219240718370503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,18247673768624689009,1388219240718370503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,18247673768624689009,1388219240718370503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,18247673768624689009,1388219240718370503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,18247673768624689009,1388219240718370503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,18247673768624689009,1388219240718370503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,18247673768624689009,1388219240718370503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,18247673768624689009,1388219240718370503,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,18247673768624689009,1388219240718370503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,18247673768624689009,1388219240718370503,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18247673768624689009,1388219240718370503,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9dc4ad191413d38325cf3222bbc5fcde

SHA1
8cc9855cb7b34c61fcdd6f3c72599a6f918367c4

SHA256
4886915da1df9833c2c783a7e946a97eed7eae4d6106f572249fb224be0a7609

SHA512
298452fcdfdc557a986ab302739fe58da50827adf78566086ccf69003746b3d49548737e3b62206567995961db5516e02ebb0355f14decccaa0c80d43e949642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d538afffd929086bfb6949f8231be0bb

SHA1
acaf260fc891684e8bfeff279ed62df4e0e8967f

SHA256
984f4c2b95837e3341ba1c9bb6f6438304d260f87c498532ed26ccb19085a3dd

SHA512
255ece9f81f09f642ac630c8531b2218196990b085d608ad05099396fc684810e00e79db081a88da0d6cf072136e21f73e2a46393855442f436e183ed204c453

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d6a4a71d279d1dde8b4f1a0ea0212283

SHA1
6a6d5420c78361223a1bcb928a1e8630cb215896

SHA256
8f86e34440a8962bb47e2ad70d57d10bc7cd71da1562ccd4683f32b86c521353

SHA512
e693eeb6699ccdddf3784bcb9e0ee3b2e9aee353b42031f59fe08ca54d0d938aa192a4f8c234426acf3db1e8099adb627f507266287ddc71f24f9c367cedda01

Download Submit