512903bd9f1cfb4b844c6e01c53820394f164393a13d0098a37ac4c2e762ce67

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

211c897dec99a734c30af0f3564199be_JaffaCakes118.html
Size

4KB
MD5

211c897dec99a734c30af0f3564199be
SHA1

608b1e3c2f9ec80c53b405bd576d81391c09e409
SHA256

512903bd9f1cfb4b844c6e01c53820394f164393a13d0098a37ac4c2e762ce67
SHA512

ed14cf16845a365e613feefc0db8cd16776f61f1a7894a4422522c5061d6abbf65b366c405a8de5ffaa67063acc8c2e2abf51feefacea0f4eb9ac853df7197d9
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ohPed:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
3408	msedge.exe
3408	msedge.exe
3008	identity_helper.exe
3008	identity_helper.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 1848	3408	msedge.exe	83
PID 3408 wrote to memory of 1848	3408	msedge.exe	83
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 3384	3408	msedge.exe	84
PID 3408 wrote to memory of 1484	3408	msedge.exe	85
PID 3408 wrote to memory of 1484	3408	msedge.exe	85
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86
PID 3408 wrote to memory of 3068	3408	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\211c897dec99a734c30af0f3564199be_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0db446f8,0x7ffc0db44708,0x7ffc0db44718
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,18305243741932338547,15326642313812788394,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,18305243741932338547,15326642313812788394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,18305243741932338547,15326642313812788394,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,18305243741932338547,15326642313812788394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,18305243741932338547,15326642313812788394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,18305243741932338547,15326642313812788394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,18305243741932338547,15326642313812788394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,18305243741932338547,15326642313812788394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,18305243741932338547,15326642313812788394,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2556 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,18305243741932338547,15326642313812788394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,18305243741932338547,15326642313812788394,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,18305243741932338547,15326642313812788394,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
b3c75b9858b897e44dd5b6e74d84752f

SHA1
5211f4fc0fbc569602b010c418968a70f002fc13

SHA256
7d8acb5ecbd8e61e10fccecf4a6c976fd50ba9f7addfe706d4ff0ce43b9497ef

SHA512
69f631c96d47d7bd860530d4324217d4126c2f475d97b874cb3112527808feafb837adea786cda5f0de97b1fc2d7d766cd25fbcd9b949c18d7b3712c4b39ea48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c1b32de1de33fe610cce122441dedaa4

SHA1
92fd02224940004eae338b89a0e43221cc93711e

SHA256
375b74aa386b8085e3dc16853d357a2df9d9bb152850dab2dd5cae3be772f497

SHA512
211f0a61bd18ae6794beaaebd32e8cfdd08a5119214e3b45f4e99289c19edab76d7c152fad88f4f221644021b5e71881f26369c5f1f133a514d073de82622cad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb0598de319c1c22e557ba4d1c4fe6bb

SHA1
335d97418d14d3c2dfa1dc6c2688992c876bec67

SHA256
d93bdf8d854df5941fbc55c4b662eb44539383c015d722fb1c891c0a608839e4

SHA512
10d0fc2f55c6a04925c4d221848205d4c80624d522e46900666060b568e69627d6cdcf3032aecb4f3012564bdc78d8fbb08ab32ea4640c366d27057627b0e2c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
08684a63f658f40352dbf2e6b0c0d2cf

SHA1
2427100c5e610e189cde5f0bc854110fe98c6144

SHA256
24936189a5acdc4c8885a9273739fb42d09d59eb3c19c492556b6008d0b0ba6a

SHA512
b11a6949c08c5dbcb91ca3c1884bb1678ffa303dd9174871a51271b019d0c49b12b3b3b986a5d54935482d5ad8fddd383a4d244c6990c04cd398e2850d8064cd

Download Submit