f7efffd8f0a0edda2e0ad8f72385219b2f285273b6528f1ccdd65965dce621f1

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21c82ed6c8c716ca591ad9c7e378940e_JaffaCakes118.html
Size

35KB
MD5

21c82ed6c8c716ca591ad9c7e378940e
SHA1

96c6c8d289a4314eb93d1348a43137e325c7dbac
SHA256

f7efffd8f0a0edda2e0ad8f72385219b2f285273b6528f1ccdd65965dce621f1
SHA512

225193438856fb7ef2b8dbf11021e665d272d52cd7a9d8a0b48fc0310d70d2afe8196906163f5376a1b46b19e1d24974f81e0f508116934b7bd9908177aa0f5c
SSDEEP

768:WIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZCSS:WIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe
3756	msedge.exe
3756	msedge.exe
3412	identity_helper.exe
3412	identity_helper.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 4980	3756	msedge.exe	83
PID 3756 wrote to memory of 4980	3756	msedge.exe	83
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 1876	3756	msedge.exe	84
PID 3756 wrote to memory of 3824	3756	msedge.exe	85
PID 3756 wrote to memory of 3824	3756	msedge.exe	85
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86
PID 3756 wrote to memory of 1864	3756	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\21c82ed6c8c716ca591ad9c7e378940e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0db446f8,0x7ffc0db44708,0x7ffc0db44718
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6861008333989966500,15427578247165710273,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6861008333989966500,15427578247165710273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,6861008333989966500,15427578247165710273,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6861008333989966500,15427578247165710273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6861008333989966500,15427578247165710273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6861008333989966500,15427578247165710273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6861008333989966500,15427578247165710273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6861008333989966500,15427578247165710273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6861008333989966500,15427578247165710273,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6861008333989966500,15427578247165710273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6861008333989966500,15427578247165710273,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6861008333989966500,15427578247165710273,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
308B

MD5
bff83c33a05198225d907d96bdeb3f6e

SHA1
b50c500350cf1c7439d1bfc56cebd38c3183c11b

SHA256
c91f7704427b7772a4f2c0a2168541af6650008b27795e1669dc99d871a82338

SHA512
35f88924a9e112140ff5cd9442542f4d8840b54438ef7c2479a1f55369c4c0b0f520434f05f02a7c991d69b3a3e199d59e96662ca37134516c8bab3829e45c1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1d6f9e50a201c98e48d4c0f95d147404

SHA1
61f0a5e98da6fea9379743c976a7079bcaaafb56

SHA256
cd5b1d5db33e819bfc62c9e0f497a528668d8a844bbb27fa71ee9470f607cff6

SHA512
8ee3c7c0d28dd4309184834662bb643ff6348282d6549314cc33105c3674d7a00360101d1076208f416e4f48c7cf4d3b0ebef5fde1a9eb2159e4bc3bf3441a8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
154626e03efadf780db2fcadc95fb9a3

SHA1
6da1240422f795ef0a9b0976936d1dbac2587cca

SHA256
d89bfedd49211df4f26103ac8972e1c181c33f346828b70f7821a099c5fb1964

SHA512
ed70eaec0141651649152f9e5623950d457ecde407e7fcaf43526ed8ea6137ad13d4d3cb6d21521b92ba47dec0c3cdf43373c840aa7dca99f4ed19f95f1d86ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
090bee0497b74fd567be5eb28c24f8e1

SHA1
68fb3cabea74c89a17dc6dafcfb722feac97f77f

SHA256
031cbfce50689a45458ddf46d1346728fd398d774490882ff2e09ef77c1dd51e

SHA512
dad4774e9a204995ccfbdee8eae3e0904ea2aa7358e3ac2b079c5c573bc63a9a393de42caaf6dc21c97aac26cf829daef3a729f4374fa8e200ecd05b418f92ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
52eccd1b9e81a5c0335f63f6560e04d7

SHA1
8a301213dedb8122c07eac2da290db383490c7c9

SHA256
1e5830345326ef9b1fb926667721efde3bf0a4f75b588eb0cdfe451eb77c2fb9

SHA512
6648d91f98ba9e1623e959f3681317f29042cd0d3a60a6d28500e33eba5096cf5fcad6b6f531bf3a5f48d47a609073bb1f86e8512ae81846b99923f6837ddf77

Download Submit