ee13602e93da6435b2156da216fa14f3c6c7039746b0dc42cd99b46cc1e90a90

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f24e5eb292bdbcea4b5c29ef2287b7a_JaffaCakes118.html
Size

933B
MD5

1f24e5eb292bdbcea4b5c29ef2287b7a
SHA1

abd9b5a263b201de67ad9c23452fb413556e1e97
SHA256

ee13602e93da6435b2156da216fa14f3c6c7039746b0dc42cd99b46cc1e90a90
SHA512

2935b20b29848979c494b22c9101681331d3dfe59ff4a85f4500b2180caf7d1b1739ed36363fe9cde578cad11b77dff4f9042c907b31a11e5d27e1003a52b119

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2012	msedge.exe
2012	msedge.exe
2888	identity_helper.exe
2888	identity_helper.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 3428	2012	msedge.exe	84
PID 2012 wrote to memory of 3428	2012	msedge.exe	84
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2872	2012	msedge.exe	85
PID 2012 wrote to memory of 2864	2012	msedge.exe	86
PID 2012 wrote to memory of 2864	2012	msedge.exe	86
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87
PID 2012 wrote to memory of 1548	2012	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1f24e5eb292bdbcea4b5c29ef2287b7a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5cc246f8,0x7ffb5cc24708,0x7ffb5cc24718
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,7698287376543121886,15206234840288880492,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,7698287376543121886,15206234840288880492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,7698287376543121886,15206234840288880492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7698287376543121886,15206234840288880492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7698287376543121886,15206234840288880492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7698287376543121886,15206234840288880492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7698287376543121886,15206234840288880492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7698287376543121886,15206234840288880492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,7698287376543121886,15206234840288880492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,7698287376543121886,15206234840288880492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7698287376543121886,15206234840288880492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7698287376543121886,15206234840288880492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7698287376543121886,15206234840288880492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7698287376543121886,15206234840288880492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7698287376543121886,15206234840288880492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7698287376543121886,15206234840288880492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1916 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,7698287376543121886,15206234840288880492,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5372 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9dc60aef38e7832217e7fa02d6f0d9f6

SHA1
4f8539dc7d5739b36fe976a932338f459d066db6

SHA256
8a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32

SHA512
18371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7ac03b15b68af2d5cb5c8063057cc83e

SHA1
9b2d4db737f57322ff5c4bbddd765b3177f930ab

SHA256
b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700

SHA512
a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f9cf9aed7582616c0fb2e51f1151eba1

SHA1
259f6a0eb41acaf26c075f6916e6a292cc0bedab

SHA256
4b4c8be3184b710fb4c980ea50f3e18de28cb5d64be2fa75c7960c5d4352e06a

SHA512
c516373222c4f95c5b260d80fa176c3971b4776f8a0c07704e500b2c34bb70825e4b15b264d593d31dee6c70aeac4f421431b2fc1cb35bfcf76f16ea69437e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
afe53c9e3429a4a38c3709627b171acb

SHA1
3812b0428624b5d1eaa07c0b46fd83d9c31d672e

SHA256
8d6415de62cc6ef741d83404ccbb8a3c632a7dd2bb37a685b2f8386c3e5c3901

SHA512
bdc6c7eb80ced0dcdd5ca4b9bbf2b7793301988db24055c508271f6831f320958b61768e4b38473db9913d978a08de3e6f10daf174194d3bd3a6c308ecbf606a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ffe1361928835a2c3aa0e30441cb3cc0

SHA1
c200cdc1476d2a6db553fd4239b8d414b2b36781

SHA256
75d66f157ec0c34036ee8a1b0e433b4ff134f033d78cdb005a4944b1b0375e11

SHA512
472f11c6010f96b63975bdd2bf778005e94c34a13dbca8e94903ab3d23c0aa8aed25ff04123dffc7293e7c573f2898864340281f74a343b957c5f8fbccf2144a

Download Submit