d8fc585e9ef6f11be19bd285bc2295f68bb5baaeab9b5e0c7322ca264e60e910

Analysis

max time kernel
148s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21dbca0cbb0de0d7492ca39593a2940d_JaffaCakes118.html
Size

158KB
MD5

21dbca0cbb0de0d7492ca39593a2940d
SHA1

2c653b0d7ee37af2ff272ca11be9439d5fbe64c1
SHA256

d8fc585e9ef6f11be19bd285bc2295f68bb5baaeab9b5e0c7322ca264e60e910
SHA512

73ceeee40ce51210ce98c5ebafdae82add5b44fad51ea3eef25b2ce886c5ddec04079ec82de5d3186f44e4d40b49ed5a69b189031a06b09a8539785b22ae9f33
SSDEEP

1536:iyRTGlOuHiruhFyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:iAViFyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2192	msedge.exe
2192	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
64	identity_helper.exe
64	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 3156	2192	msedge.exe	83
PID 2192 wrote to memory of 3156	2192	msedge.exe	83
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 4436	2192	msedge.exe	84
PID 2192 wrote to memory of 2016	2192	msedge.exe	85
PID 2192 wrote to memory of 2016	2192	msedge.exe	85
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86
PID 2192 wrote to memory of 3656	2192	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\21dbca0cbb0de0d7492ca39593a2940d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad7f046f8,0x7ffad7f04708,0x7ffad7f04718
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13872564468889083844,2239213279557006176,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13872564468889083844,2239213279557006176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,13872564468889083844,2239213279557006176,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13872564468889083844,2239213279557006176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13872564468889083844,2239213279557006176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13872564468889083844,2239213279557006176,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13872564468889083844,2239213279557006176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13872564468889083844,2239213279557006176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13872564468889083844,2239213279557006176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13872564468889083844,2239213279557006176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13872564468889083844,2239213279557006176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13872564468889083844,2239213279557006176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:2404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3a0755305ac454e20356b38556153eb8

SHA1
67ed18e01142655280449c6d16633a1fe0f6b3c0

SHA256
67c83d93cf8bb9185abd3345e94384b7bf1520a9aff6ab4b599d2c5c15787f2a

SHA512
08bc22d4bbd15d2bbb0242202d7cb8c26f357f1e361ffd443a450cfd9b142e6e45c7ba9cc8a3dca5ad9e9b4613e0659aff6007bfec4c2b52b15e01534e7a2b66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
877c434ffd34703c11d60db95a32d88a

SHA1
c3091a06d9b5c28c656a7c06a0feb11b00fc7f0c

SHA256
a73dde88def3c1dbbd0824fa223bf5f111d47baaecd6a6efe3dcff891938b553

SHA512
e011aa89ba1f7affebb4742f420597ae1a8e225be2f0cd04b3476554dea6971e94ac5b936e90117775d5972b566b03d8f4dfdf783c143063435fd2f39dba933a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5b122607ca0afbf224c9b78cc1b9fc76

SHA1
f64f539c7ec937bb72097f0a6d1cad7b7930b4d2

SHA256
3cd10a533f01c79c7b6105ae5c9036935db927ff2d034479f587bf2f60107dbc

SHA512
7d2fc6da890b368240e428e4373d9d844fc2468370b7dcca398e68ee54eb968e45022d01ee99c43edc774f29948b2849094eb05679b1ff89b734300d6fe7431d

Download Submit