daa05737bebfea101dd8d864764aea92dab12135cb1c1afea52069218035e464

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2184e21af54835d944e2cef23dd6d18b_JaffaCakes118.html
Size

2KB
MD5

2184e21af54835d944e2cef23dd6d18b
SHA1

ec51085e9c435484df022518088c1d270ca8cb05
SHA256

daa05737bebfea101dd8d864764aea92dab12135cb1c1afea52069218035e464
SHA512

8de0e137b594df4acb9d31501e81b7d40724253190577c4c51f1fc3a82d70d42b2cef579013f97435865184b6141388a8cd470d7dacc78cc539ab051e1af1b61

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
3568	msedge.exe
3568	msedge.exe
972	identity_helper.exe
972	identity_helper.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 4652	3568	msedge.exe	85
PID 3568 wrote to memory of 4652	3568	msedge.exe	85
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1572	3568	msedge.exe	86
PID 3568 wrote to memory of 1688	3568	msedge.exe	87
PID 3568 wrote to memory of 1688	3568	msedge.exe	87
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88
PID 3568 wrote to memory of 808	3568	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2184e21af54835d944e2cef23dd6d18b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa44546f8,0x7ffaa4454708,0x7ffaa4454718
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4635341115536861423,2466059498612674848,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,4635341115536861423,2466059498612674848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,4635341115536861423,2466059498612674848,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4635341115536861423,2466059498612674848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4635341115536861423,2466059498612674848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4635341115536861423,2466059498612674848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4635341115536861423,2466059498612674848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4635341115536861423,2466059498612674848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4635341115536861423,2466059498612674848,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4635341115536861423,2466059498612674848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4635341115536861423,2466059498612674848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4635341115536861423,2466059498612674848,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4635341115536861423,2466059498612674848,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dec44b6840f7fb8eaade3ae29d8bc4e5

SHA1
62341db54efc681522162db57ef122e03a1c807b

SHA256
93198e0ddaec25dc9a521fe33208b390de699ff395818fa3be4f0afcbcb1c362

SHA512
b95a8695527531069dbd8fff0dfabaffe175f9b2220d26d64fed09fa436689ec9acacf5147382e7527dc0f4758b57f684d2449214c9af7b2295c64d255235322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e2bb64700feb836d327ffed24325aced

SHA1
61a559c06e833ea1c1e5afe0a78b348dd79c2c80

SHA256
6537cc2ecec2bec797c25b3d239fbdb43075deeb0979cb319fd13ec7bd6120bc

SHA512
fc35dc7a35f202daf00c276c672c03928dbc1c2cd3e476c7532b768fcd1abc1db16a747e8696dc5cfb3dd75c141d2a9e28e86b899d0e8e9a2ee59ec3c55aef63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c0b5a5e80638534c158d52b2a2a23e90

SHA1
af70ec5e2954ee96ec33787874de71225be6f73d

SHA256
338bf8be33be98b9c1b9bd99c8bdfbeb9575a61893fa2ce051a4021b67817e40

SHA512
ea48c715cf1e6d856fad348ba3ea79d6bea1c8b892598e57b5eeb0ecb986efe6fb7f0b83dc0b03634eddbfdaca04dff5663c7d72ef2886160136333e2ee8b4a0

Download Submit