2c3d2a481627879dcd9f769237a0ccc648b2f7208293fa128117058060eb675c

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21c5dc5662d84d4a010077fef323211a_JaffaCakes118.html
Size

5KB
MD5

21c5dc5662d84d4a010077fef323211a
SHA1

5acf0771fe6f7abd781fecfda2736b6c47890809
SHA256

2c3d2a481627879dcd9f769237a0ccc648b2f7208293fa128117058060eb675c
SHA512

1fb02a59906cae66bd286f580ec53f90819b063b4617d521fe6d455ca7f804f940e94607990d2b5be744765ea4d330cc0ec7abba8095d631560d3f6e6c0dd528
SSDEEP

48:20R9iVnRTbV2vhhbqekaR60nkomVhRK+9yi9wko+Wn2rpM:2hx0qeki4omBK+N7o+Wn2rpM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
3708	msedge.exe
3708	msedge.exe
1564	identity_helper.exe
1564	identity_helper.exe
5596	msedge.exe
5596	msedge.exe
5596	msedge.exe
5596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 2060	3708	msedge.exe	83
PID 3708 wrote to memory of 2060	3708	msedge.exe	83
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3868	3708	msedge.exe	84
PID 3708 wrote to memory of 3232	3708	msedge.exe	85
PID 3708 wrote to memory of 3232	3708	msedge.exe	85
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86
PID 3708 wrote to memory of 1572	3708	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\21c5dc5662d84d4a010077fef323211a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf6b546f8,0x7ffaf6b54708,0x7ffaf6b54718
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,10874480896163265344,13446067227368261676,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,10874480896163265344,13446067227368261676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,10874480896163265344,13446067227368261676,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10874480896163265344,13446067227368261676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10874480896163265344,13446067227368261676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10874480896163265344,13446067227368261676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10874480896163265344,13446067227368261676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10874480896163265344,13446067227368261676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10874480896163265344,13446067227368261676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10874480896163265344,13446067227368261676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10874480896163265344,13446067227368261676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10874480896163265344,13446067227368261676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10874480896163265344,13446067227368261676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,10874480896163265344,13446067227368261676,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5164 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b21d8f251cbafe5346f7ac625d2be86e

SHA1
690220c46e44e72f88d5707a8920af8f3890c83f

SHA256
26530157636501b228a6a0267a13f325aa81526d7f94d7a1173a9a167774ed82

SHA512
2367dcb0fbe919f691065787fb519d51188337830f1f49d5906dcba46718d475cd91cc6c6b191ebead992a5532ba9c56132f82926b0a743db5d3deec2c81a249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9f511b38529bde7c1c8a8a05e96cd3fd

SHA1
be5f4d4a8154835687d934f536a89506a07a07d9

SHA256
78a87aa3403d6647dec038647efdf1ca091e33b16f8be5e5a4fa63cb0f3f09e2

SHA512
d788352735e634d19b05ed9240e3256e013f7073e3c84770026f8d5b29ed474c4e40ec76db01db137a191c288679f1a424d4b08f364384fab36bfbf0799c364f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
332d377710a305c80eb3cf38a28878c6

SHA1
8d13aa613d39a68a244b5d6f4eae24548fee0a66

SHA256
5fdc1f325f3e4c7268adcb129f94301c23444225a15440feb39dacc9774c7b8a

SHA512
2a78e77eff2d19946cc591306b4ff289049e113be730b5e81e7b9baba010ed8bd2ae1ce0d9e03915ff82765088f645c60336aadcdabed798715d1ee4a8859a62

Download Submit