2c68cdec18c014acb6656e64259833ce5953e29d4eeb81ab6ec442746d2d5207

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fcc12f3d9d0f7e4dba40d2c6140b55d_JaffaCakes118.html
Size

41KB
MD5

1fcc12f3d9d0f7e4dba40d2c6140b55d
SHA1

8c89dea2e18f617e56443bf8c56a838d63bf2578
SHA256

2c68cdec18c014acb6656e64259833ce5953e29d4eeb81ab6ec442746d2d5207
SHA512

99cabb5fd9007621042bcea467130eeeb8c0156fdad9b656de0c12cc3b517a0b52d6e63cc53f21094cd03a8c8ce061153dbff90eacd590128c80dfe800c2c713
SSDEEP

768:SN1xhQGuWq78QCeCvC+CGC9Ex0oZCVmfNjsUN3RtjVEV:SN1xh5uWq7nj+FrWoQ2N7jiV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
1388	msedge.exe
1388	msedge.exe
4352	identity_helper.exe
4352	identity_helper.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 3132	1388	msedge.exe	85
PID 1388 wrote to memory of 3132	1388	msedge.exe	85
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 4436	1388	msedge.exe	86
PID 1388 wrote to memory of 3408	1388	msedge.exe	87
PID 1388 wrote to memory of 3408	1388	msedge.exe	87
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88
PID 1388 wrote to memory of 960	1388	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1fcc12f3d9d0f7e4dba40d2c6140b55d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdeb4546f8,0x7ffdeb454708,0x7ffdeb454718
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,12323719542056109330,887667898486232053,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,12323719542056109330,887667898486232053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,12323719542056109330,887667898486232053,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12323719542056109330,887667898486232053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12323719542056109330,887667898486232053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12323719542056109330,887667898486232053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,12323719542056109330,887667898486232053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,12323719542056109330,887667898486232053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12323719542056109330,887667898486232053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12323719542056109330,887667898486232053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12323719542056109330,887667898486232053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12323719542056109330,887667898486232053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,12323719542056109330,887667898486232053,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9f0c9528-f094-4b16-a7ab-3b069f60a4ef.tmp

Filesize
6KB

MD5
2afefe32a23b664490ad9c055aaa8c76

SHA1
06ca74ad737782fc5b5f55bf7b59a850fa8141f4

SHA256
d70ca198271055a2db5f86b161f5312f41b624a5beaa43aaf6d008cdf3a2f951

SHA512
97fccea0824a35334848c717e393f8ea1b38796888fb62ba49b29459b3a7d97b5057b6c550fc3de30d09dc32520a5d5cb13500077c958cc998934c99d7da086a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
7f9f49296d964d3afdbcc1b48e515ad7

SHA1
2d042b0421858b6f82c15d61cc321dd7ebe6646c

SHA256
a3d1b60c3f0b7c45f3bfb02a8c0d521c6ed59f69b2dfb8ca690e1760b7c7eb24

SHA512
1814d4f166cfc05d5b2b8fbac4f64142b38303fe85d2bba9d2ddfaab8fdb483eabe30d1089ba80755f2e4ccab61ed2c9f7f2a244ca30301c620d6076574b3484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2217feb3377f78119afc7f50512c820d

SHA1
6754e805bd19313d2d1fcfc1c3c137f11abe5bd0

SHA256
bed1a7aef1664e3c6668dc798b40506185e2adb79a89061303905aaaf68b51a4

SHA512
2ca5a7fe78ccbae01dc2a3f141d8e2b694ab0ef1e036f46aef1419fdb10ebfe220c443c025ceb61197bb6462e7c15488407d6e8aaedf32d903a5eab81ca6a5a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ba4ebd4fe89cba205580ff2d47c9b8aa

SHA1
bbf5a491600d252619d4875f6447fea82d0d9326

SHA256
2d1691a8840448a945002c43282800a70b94d0b3774367848f3fa8d842f3e129

SHA512
5e9f4f0632506c88604da3c179768019a855508591aff47d8da9a501697d40949c4cfe1b00c448755a548477b800a4e249af88f56986ccd3a8f66fde27a1d50c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f0481dead9c7a1eb1b2a9df92ffba0c8

SHA1
efa89ca069844ae5786522d3a06562ce6ccb2609

SHA256
cb9502d9065805f86c802b07e8fadc54fabad40dff54c888e9501633641cd9e6

SHA512
b1d55b40365d908aca26dac4b540f5ac17b0d693e416227352d6a11c473026a58c1e7112086ac39f3f023d613e256ddfe0371eb1b218a1183c68820b5c7c0697

Download Submit