f171bc58501f1576083308f0e72fd228a97d1811d6704f118eaecff3c4428520

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1f7e3f49045809f4bf67596f3ec30538_JaffaCakes118.html
Size

6KB
MD5

1f7e3f49045809f4bf67596f3ec30538
SHA1

f0901a5b3eeec01ab27ecbe60e902f96ed35947d
SHA256

f171bc58501f1576083308f0e72fd228a97d1811d6704f118eaecff3c4428520
SHA512

291340b675dee378c64d2fdfdeedc5e8a5ff870e013ee27ba8f146949839d450048115f061cc231f529c97cbba33360cefdc08d6f18f8908a4823268523ca4c2
SSDEEP

96:JoPNP9UdpF2+9SYhDvlBI+VMalK59DTAdNdYnbbKZhlLJmbZs4TdRNBJOhb2ZVE:JoP3mpgEhR5dCOklE

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
2444	msedge.exe
2444	msedge.exe
1284	identity_helper.exe
1284	identity_helper.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 3416	2444	msedge.exe	83
PID 2444 wrote to memory of 3416	2444	msedge.exe	83
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 4072	2444	msedge.exe	84
PID 2444 wrote to memory of 1656	2444	msedge.exe	85
PID 2444 wrote to memory of 1656	2444	msedge.exe	85
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86
PID 2444 wrote to memory of 2832	2444	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1f7e3f49045809f4bf67596f3ec30538_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5c2346f8,0x7ffa5c234708,0x7ffa5c234718
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16298141195257428181,980529052094543408,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,16298141195257428181,980529052094543408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,16298141195257428181,980529052094543408,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16298141195257428181,980529052094543408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16298141195257428181,980529052094543408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16298141195257428181,980529052094543408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16298141195257428181,980529052094543408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16298141195257428181,980529052094543408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16298141195257428181,980529052094543408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16298141195257428181,980529052094543408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16298141195257428181,980529052094543408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16298141195257428181,980529052094543408,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5324 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
255B

MD5
7f8a2f723513ce9d33398ec7cb8da333

SHA1
53eeee482c75073cc2e3d49fcff2e644256d4275

SHA256
32558d2c8c4e809cf1b2d220f074bdb8cc1d339d4a5ba3edf9544dc32893fa2b

SHA512
ea6569fc08b95b7904452aca9bbd9063aaeab76f49f13be1f116a5e31038cd64acc4183c0a98507402092c7b2ccfb8d4aa25f3469a03599e7fdfa06535f256ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cef48fbb40db4155238892374934cc4e

SHA1
2eb438408fed5d047180a3cd10709c11063121e2

SHA256
702ceb6e7868a11f6c760c10cabea6ec1e302e58640e9b625d4931b3b7e920d0

SHA512
e1b174d31db0a4544d6c215985d3121c55297e5b2e1afe8679ea5da7a3c0418c79e20ac517cd307f016cfe8c76c90685ea0b277dc6918800de4dd9a0a3701273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3f99bf9cd7cb614406ed3410a2d2fa7b

SHA1
42c2a524173c9c6ff6235f961e87f6690e669091

SHA256
cfc01796df4e9d28d91b4feb08be47ba7000070d43e9c00cf39aac028d6fcf89

SHA512
b1525a9d75f3c19cef96c07b9577d06fcb54a67296a218b15e82cdbefdff436bcddf8ebb4cdb88d4e2dd118fcd246b6f63ebc136035f9aa532aba096c67162e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a704e9ee526307192dfc227800166a1f

SHA1
a472750fb2ebd9121c4cfc72ad7e6121dc6a29a1

SHA256
15a5478bc652829e9f4c65061aba0df9b610b614de4cf5ace370a17085008def

SHA512
c50c630b2efad6a8bf9082636111d0f724fd651004b155a7e174666b08f751ca4c98d498906b6b271f30b8535a1edd7114048a3105f774ac45e61c57aac717a6

Download Submit