db73c0d872fbd6ba785912b33a1a0cafcd3a4474f602875ce25d03ac00c6d382

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2168511e1dcff88821b965ca658faded_JaffaCakes118.html
Size

28KB
MD5

2168511e1dcff88821b965ca658faded
SHA1

63745c46b9d3d91ac23efd5f04e3c0b25b99bc25
SHA256

db73c0d872fbd6ba785912b33a1a0cafcd3a4474f602875ce25d03ac00c6d382
SHA512

55cbf59d820e53565d6b152b52f6d21c4fc9cd100f1f59f2e0fd13f29afd0a751922ffd31af752bf79e88362620d2cef3fae1f6ce127380dcd57239aaa76123c
SSDEEP

768:SxzdsFqvfudlQVV1C5m1CCCcmzm3C/CnCQG4MVSmz2:SxdsFqvfug1C5m1CCCcmzm3C/CnCQHY8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
568	msedge.exe
568	msedge.exe
1612	identity_helper.exe
1612	identity_helper.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 1452	568	msedge.exe	84
PID 568 wrote to memory of 1452	568	msedge.exe	84
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 3824	568	msedge.exe	85
PID 568 wrote to memory of 4692	568	msedge.exe	86
PID 568 wrote to memory of 4692	568	msedge.exe	86
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87
PID 568 wrote to memory of 3608	568	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2168511e1dcff88821b965ca658faded_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd9ed46f8,0x7ffcd9ed4708,0x7ffcd9ed4718
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,6258191131036656934,6350968871745850545,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,6258191131036656934,6350968871745850545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,6258191131036656934,6350968871745850545,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,6258191131036656934,6350968871745850545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,6258191131036656934,6350968871745850545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,6258191131036656934,6350968871745850545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,6258191131036656934,6350968871745850545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,6258191131036656934,6350968871745850545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,6258191131036656934,6350968871745850545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,6258191131036656934,6350968871745850545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,6258191131036656934,6350968871745850545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1804 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,6258191131036656934,6350968871745850545,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1d2ed437ebe6f2f11858235a54f5c45d

SHA1
906fd82df84fbd2b9f343d61845c5208ffe54ec0

SHA256
aeaa84f81aa513fc1d50c59dfcf9fb1e12e0d1a490a6751ab0c27fb110d1463d

SHA512
418c8fe92a12efee7418c9ca8acc61d36dfc88006aec144b123e4ad7d679e1f7ed335ab204082843d87652c117c8b82b886abf07ce24cced4234ba3accab01df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
36ab2fa214146bfb704c7b9aa97bdbee

SHA1
8d8db53af1278f5b70319ac8c170429320368b11

SHA256
4083273f11839d14d191a90de9b31592f0b1ae58d2f54f179e85dc44ab4bbc2c

SHA512
94c1ad8ce8c6cfef57ad3857c398f7ab3e209869e5e3b8ada3551b12a748ef2c765c24b163b4d5112312fced3c8d5c87cf69dcd61cc34b696753dbdda1cac323

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19867d2524b8536242486ec3c3ab56e8

SHA1
534a1a34694a2bcc9bf7ecb88777df6b1b74ab63

SHA256
98a76200d2dab8bf90ace1144e1c2085ab799ee3fb84a27aefb2d42fbec15fc9

SHA512
cfb1f2ad982758ad37c8be3a73df6fff8cdfa50db21f58366ed6839b72e09e8816714a2256c492c729171eb190f70f89a6656f77e972f3b421d0973b9142dc3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e741001010cab5cbb962d5609c0ee7c9

SHA1
f0aa4417c0a8e23811c3c7c27c40105fb73318b5

SHA256
7f16096098c0f0731ddc2ec4c7df3f951cfd03947502493ea7aa1a5e6f8b395e

SHA512
d9ab21509d8c197e3295d9a7bead04d077b3aa800ddc85486a7c81b45311c6b9e43a1c6c05e7b37a3c0ff99d3d5668115e875b36ad202b1a99d09b2bcbece2a4

Download Submit