cf98e30eaeb59b875fded19b8766b915a07c422b5626e8af6916a284db9a8b2e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2a67888e1a1ed74b3ee3e9274ed7de6c_JaffaCakes118.html
Size

36KB
MD5

2a67888e1a1ed74b3ee3e9274ed7de6c
SHA1

0faf3fb4813432b411d7e71ccdd31014b7e946de
SHA256

cf98e30eaeb59b875fded19b8766b915a07c422b5626e8af6916a284db9a8b2e
SHA512

3b24aaa39549ca72bff86a21d4eec42391306701c65384044436b7165977f42753b6e80c3c415f7705516c55dec411c709d93342d9845a93b54c2d704cfefaf1
SSDEEP

768:zwx/MDTH3P88hARxZPXIE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TuZO/6cLu6OxJyr:Q/DbJxNVqu6Sl/u8iCK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4596	msedge.exe
4596	msedge.exe
492	identity_helper.exe
492	identity_helper.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 1292	4596	msedge.exe	81
PID 4596 wrote to memory of 1292	4596	msedge.exe	81
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4916	4596	msedge.exe	82
PID 4596 wrote to memory of 4764	4596	msedge.exe	83
PID 4596 wrote to memory of 4764	4596	msedge.exe	83
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84
PID 4596 wrote to memory of 3980	4596	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2a67888e1a1ed74b3ee3e9274ed7de6c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ace946f8,0x7ff8ace94708,0x7ff8ace94718
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,7673754247992019880,9935181576883888400,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,7673754247992019880,9935181576883888400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,7673754247992019880,9935181576883888400,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7673754247992019880,9935181576883888400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7673754247992019880,9935181576883888400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,7673754247992019880,9935181576883888400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,7673754247992019880,9935181576883888400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7673754247992019880,9935181576883888400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7673754247992019880,9935181576883888400,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7673754247992019880,9935181576883888400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7673754247992019880,9935181576883888400,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,7673754247992019880,9935181576883888400,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2976 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
6e5aa3aa18311ea860b3afc4540c498a

SHA1
509ceffe8ed6e1a4994c91c418df70b04adaf6c7

SHA256
3802bc3009f5926ed128107bc37bb4dba5435924bb38e9b60da75f15fd88659b

SHA512
22a90f1b955bb955a5284a6510e6af97044dc49cb979d7970c705cb43ea8f90a9d1a5fe79b8031d45d12191a5cbda868fdeb907ba5fc7f7d35a96041eff00823

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f97883d8124147de934ef27a11d2da7

SHA1
566878cf8d09c9714837e37d72a0d339ecfd9599

SHA256
27789d5ee35362ba061e2a10d7161b4c5ccf4164561aeefcb09d1b1df07cfae5

SHA512
37cbad96154d851e08e59faa04e44c63a9d7f7fc2e76095a204fa1793aa3c4eb7d308bbfc2a26ce252653465becb24ad2f286be24505c758cd1f8dec0356b5d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
896f6db8e6e2e47a7cbfd750f7434a0e

SHA1
5b8411ed1f3dfbb5c9c3d0e132bec8b95b8be079

SHA256
c420b97f01c2584813c73801db31908807d77c66c140fa5766c002e66966ea8b

SHA512
c033af578f5d889ad603ee905c57199271ad0e121f89cf87392b30a9c892a5f7b8d63749a180a3f7968ca522b272ebdc63ab85c839903aaed9253a29f987c004

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
28fff0b53e05121e0c1c1068a53246b9

SHA1
e6bd14dd774e6d7e1c9413067bfc9a3313a12529

SHA256
936a11993de2d550aad8b8e5e3ac6aa44f0873e1dc8ce4c24a9dabf806b37a20

SHA512
3fcf9becb3cad350abeca0e3e2174b4eac36159d151d72f34eefe72ccc782fb4c82d125ec1c797a0fdc4003489fbb3159c446a7ae15e1b782a6f4ad181b1fec0

Download Submit