829e7160fc407aaa9d0bb0d89f344f56a210edad823a055c9e52ae501a81da19

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 07:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1fdb939d39b0c8eec978a7978fba2378_JaffaCakes118.html
Size

34KB
MD5

1fdb939d39b0c8eec978a7978fba2378
SHA1

d16debad9738eadbc5befbafbc751764c9a67527
SHA256

829e7160fc407aaa9d0bb0d89f344f56a210edad823a055c9e52ae501a81da19
SHA512

8d9ec430f6c303be4d64d0d783f654dd9059dd5a44530696f4646ad2bf6b9e0ed0428e4949bdd9639ff23225c61934c8f58357dc3187fab5ec0d56fd143a72bd
SSDEEP

768:/s2lYtjDI/4xcN5q80aSQaiwlzXGwGNTj4BTsHJZkSTMbhqBOtz:FOON3SzWwGNTj4FsHJnuUBW

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3776	msedge.exe
3776	msedge.exe
4396	msedge.exe
4396	msedge.exe
4648	identity_helper.exe
4648	identity_helper.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 3556	4396	msedge.exe	84
PID 4396 wrote to memory of 3556	4396	msedge.exe	84
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 708	4396	msedge.exe	85
PID 4396 wrote to memory of 3776	4396	msedge.exe	86
PID 4396 wrote to memory of 3776	4396	msedge.exe	86
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87
PID 4396 wrote to memory of 1944	4396	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1fdb939d39b0c8eec978a7978fba2378_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6d5646f8,0x7ffa6d564708,0x7ffa6d564718
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,1044421539011505511,8315809714849657785,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,1044421539011505511,8315809714849657785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,1044421539011505511,8315809714849657785,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,1044421539011505511,8315809714849657785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,1044421539011505511,8315809714849657785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,1044421539011505511,8315809714849657785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,1044421539011505511,8315809714849657785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,1044421539011505511,8315809714849657785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,1044421539011505511,8315809714849657785,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,1044421539011505511,8315809714849657785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,1044421539011505511,8315809714849657785,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,1044421539011505511,8315809714849657785,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
562B

MD5
208dbd61f617fbffee3f949ad1ccebe9

SHA1
378ec8f934217024e51f1089a5d5f96081e938ba

SHA256
91beef4d248aa55b32d415d88c5a18eb81cae1c67e82047f71db1c1591a18cb4

SHA512
e490c6ee11a3eb1be0edb38683bab4d7907e2cc042861239324c173b7ebcc103bfb0e2c631672d47d9939d96bf2207635df9793230c9da1a66e7fd319a9da4fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
237b1d0682516b4d560f0bef1fb60721

SHA1
5bf919eef3b2c9a1f87f15a90d92f9f8663511ad

SHA256
5b4ce42dc50575f8d535ed36b66c6aed3b9ce5b9d64cca53c14a1532df3f3a7f

SHA512
7698672124cb10c6d3254e9a354ad20c1ef0ea85a02338391c606c118a6fab4d06845bc8220afcaaaa18b40979f93605d78b406497a16e7ad7902e2c759bf6a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9bd8d0b0cd88c6380b6e389897a40ce2

SHA1
f504c34486dd3058cba4fce7dacf8d90f278fac3

SHA256
36675eda13261f23cf06c09c23de422b2fb50511c33e3ac5fa9e3086d0ca7ffe

SHA512
352da205b404376d9ed2917a07b4b3eec3bd0edbbbcd40aa5156d7323c66bfe9f1ab7dbeeb6bb736eebc3fca325646d356c4d7a3a78ec56cec35d7ad07f68afd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a42debd389a9681cdf15b5ef9986b843

SHA1
046bb390ada802e2312ac50c04356cfe69034431

SHA256
1b9a821cadc3c25df7687e4c42975814d2324772cf41377578d3e4b1e8ad76ee

SHA512
c1bf788df0c0d67be658a062493e02c7ba6c405ecfed7d008c1f445070cd596da97b65f5dc738a3a58f501adcb91d22950350622ef61406fcc403b8d54dd339c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
627f43a1ddb021fa1864fc2175a09530

SHA1
939f1c4b624f0f7d7c8917d9f2142b1b2ec5aa3f

SHA256
552715bdf00907c6725c770e6c9e91baf074f5b89119e5f85dfc6aa7f57c8bc0

SHA512
95e2f4cc1099b5f8792207cbb9d917c107c6b0d59830da6da070e9f64f6023bdfa767d4d7487bf9a33a0bf20dda1a57c7ee0b77cc980ced7727d3cae7c2755f0

Download Submit