9e32b18a20ccbcd1056db959702262cdc79ec145863358a98abe5f309b989e0d

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 08:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e51e05e2baa28938b8c9a2b6e43cf7e_JaffaCakes118.html
Size

29KB
MD5

2e51e05e2baa28938b8c9a2b6e43cf7e
SHA1

42f3a98c1270b94c0b97a2c2a307362f54183b7f
SHA256

9e32b18a20ccbcd1056db959702262cdc79ec145863358a98abe5f309b989e0d
SHA512

9bb870e0989485ef99274bdcca13eb66eeb9afa9861368f1035e2230c40271199bf6e258dc44ba2e9fa10f4fe7e8dffcb1908939992fba52fecf287c6e93619c
SSDEEP

768:UG0gWO1HiHmHfZHOYQjH4MM3HeHOH2ub8HyG4lHlHRqHZHVHkHwHsHRCH+HPHRHr:UG0gWOFYsfpOYQz4MM30E2ub6yG4VVRn

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
3796	msedge.exe
3796	msedge.exe
1720	identity_helper.exe
1720	identity_helper.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 3564	3796	msedge.exe	85
PID 3796 wrote to memory of 3564	3796	msedge.exe	85
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 3828	3796	msedge.exe	86
PID 3796 wrote to memory of 4192	3796	msedge.exe	87
PID 3796 wrote to memory of 4192	3796	msedge.exe	87
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88
PID 3796 wrote to memory of 2164	3796	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2e51e05e2baa28938b8c9a2b6e43cf7e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8cff46f8,0x7ffd8cff4708,0x7ffd8cff4718
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7161502855030955257,9770968716088143819,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,7161502855030955257,9770968716088143819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,7161502855030955257,9770968716088143819,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7161502855030955257,9770968716088143819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7161502855030955257,9770968716088143819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7161502855030955257,9770968716088143819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7161502855030955257,9770968716088143819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7161502855030955257,9770968716088143819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7161502855030955257,9770968716088143819,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7161502855030955257,9770968716088143819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7161502855030955257,9770968716088143819,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7161502855030955257,9770968716088143819,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
313B

MD5
780a44bc078ac4d6b909cd7eef72d67b

SHA1
341b8a1c1c23477bbfad92a1faa9b90d1d37517b

SHA256
9a45124ed4534e3b55189bb32c4a13f7e771fd49175e790d0cdbc2e6446dbc0d

SHA512
60b23328bbc3c09f96a1a580c2bdfe88a97d930fb1abc9beb07cb9b27980c03c0854b96d0181f392f09fc68bdc505b8963043be86bd518f1ef445df2117bf2ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
37b34e69e397b62062a55b93c550de34

SHA1
6e7f65a1b50d5ea08bfc00fb5afb26d942784de2

SHA256
7673c6376c2b86f3dc76c499b5c631383e144b61a9e165cb318da3e420de5be5

SHA512
66a937f773375b8968fe69e10955ea9d6fe4bee833a6357d3c071032a1f89c1b71e26c8440a69fa20650e709961d8075be14bdbd997b83c44a4ea63297f89678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
83a4e5369c18952913b9a374c6461c0c

SHA1
f586c59d1f6a145bb013098a4f015aa2017c5ff0

SHA256
cb19229b4c666dea442da2360b685f9eeeeefad2eebc3deabf3e431f6731f72e

SHA512
53ebe856bf788e695526c8bc1d788a60739843f68a69116f89c502c27b123f4c14dd27434e3d63871e9657358c11f037e789d10d2a94965c0779f6cff04dac9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
14c07c8285fd981b3d903bd59c28860b

SHA1
ea3e570fa12b86b34f502a13121bc6482d5b8678

SHA256
1cb5c342e92ff3738e30435b4ce5f75816523eac7ce30cae6d4d38f3b710ead4

SHA512
3a0f65832bccef672c549e4c144b8bbb5a0be57f57e1c69764741271c08ed5b7f3ef1f5a4c0d75e1428286f756ab94eb98b7384d61430a2bccf6978843402fef

Download Submit