f7f324b30b790e7f02f9275cbbbca71b686e335030416be9cdd3143cf69eb70d

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21ffe7286f5161f028dcbe588e0b120a_JaffaCakes118.html
Size

24KB
MD5

21ffe7286f5161f028dcbe588e0b120a
SHA1

f074dff28e27cf9f801df96843de2ac39b3030a8
SHA256

f7f324b30b790e7f02f9275cbbbca71b686e335030416be9cdd3143cf69eb70d
SHA512

371567488997aa3038182d2d4be9f19c02c43af3cf5efbe6c4409d75fe0091c27745f8584dcfaf8621c77f0c0075f95286b42366b2f3e0aa9717fd0aad807648
SSDEEP

384:GhpL+aGrDRpBjzRDUYUDWJK9tzShGjeqyo1KR:Sp6aitkDF9mKeqw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
3020	msedge.exe
3020	msedge.exe
3936	identity_helper.exe
3936	identity_helper.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1440	3020	msedge.exe	85
PID 3020 wrote to memory of 1440	3020	msedge.exe	85
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2156	3020	msedge.exe	86
PID 3020 wrote to memory of 2336	3020	msedge.exe	87
PID 3020 wrote to memory of 2336	3020	msedge.exe	87
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88
PID 3020 wrote to memory of 3516	3020	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\21ffe7286f5161f028dcbe588e0b120a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a92546f8,0x7ff9a9254708,0x7ff9a9254718
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1206276575078535238,11449657982104791252,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,1206276575078535238,11449657982104791252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,1206276575078535238,11449657982104791252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1206276575078535238,11449657982104791252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1206276575078535238,11449657982104791252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,1206276575078535238,11449657982104791252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,1206276575078535238,11449657982104791252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1206276575078535238,11449657982104791252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1206276575078535238,11449657982104791252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1206276575078535238,11449657982104791252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1206276575078535238,11449657982104791252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1206276575078535238,11449657982104791252,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
545B

MD5
27e85560d4fc3c4cbbab40474fc1b0b9

SHA1
85dc2a0ae4754422553e4a668f557f00164cedf0

SHA256
72dd9e9d42c330ff9d92ab76fe54d7d933ce2ff483998f2cbf3f96cdbe211899

SHA512
0ce4b1d1126af36a6474554e07276b5f1c82d8ca9e9b2a6e9553b44bd90ded941d25fd31e1c5b1983c55a135efd2b7fd84df1b0ebc382e33633d0f08dc84eeaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
20fd86d71947a9b03ca3de49a3c2d20f

SHA1
fad3802696d7a6333e97359c219f8c3240d19421

SHA256
f142884159c86f636c05de885e26f92555f9096d17b7567a33333e2559e8cf88

SHA512
8d5830232261c84b246a22455976585630a52f2f5c7b641ed7840284a8c9f17b05d8cac55d524d3913488817711edbddd1ef4898e5c695d51ad99762af65d74a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a1d520b3fd45587341a9d91d2004690b

SHA1
266f6aa4896e6c11a6a1743914b746fd5a079b88

SHA256
f3322950b9787ee79d5d2c339d87251e17bbb35df2b94653b78554fadfb56adb

SHA512
5b748edb363acb13767a53b9c451a1aae0d8872a309f523b644102a77195d570bc132dfda00474a448f1017c063d5c227c6bb0bf666ed0df7a480b210318c5a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fe88b2ee9f279cc0af1f7e7db9d5bccb

SHA1
ae2e0e6f1e1f3e6882c51273946df2f644a21aee

SHA256
5d510ce6c665230dc82c5fe8d58c650ef336022ad27f4f3105673ba6b49b4cbf

SHA512
14b3ce377c02c3da9f305eddf9a21bbf2a9ee8fdcab571d5a00e1a3a0c73d215edf4d66185eae78d2dc14a184d360a7928ae2e9d54ab2c71a744a3cbbee46c13

Download Submit