ef187ba78fe1eb59a9192ed7caac1446f401fd3e35ab7ab7251eb82b8fb9ab02

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 09:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

396b6809f5ee1d84bec40fd8a14b97cf_JaffaCakes118.html
Size

567KB
MD5

396b6809f5ee1d84bec40fd8a14b97cf
SHA1

9da4897d4acfc591f0559ba53426e0d0565f35e7
SHA256

ef187ba78fe1eb59a9192ed7caac1446f401fd3e35ab7ab7251eb82b8fb9ab02
SHA512

25867d43d4f515203cc3e2713cd0ef3237d0620008b69179483c200ab18c1319d10decda8dc66b5bb6ef60f92bb7e2686c4918eb3853f6a63c012c6451276859
SSDEEP

12288:m0fWOcHy4M2UG0PdLk/zsJuJMBRbHH8HRRfcGHXGFzE:m0fWOcS4M2UG0Zk9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
2164	identity_helper.exe
2164	identity_helper.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 3380	3804	msedge.exe	84
PID 3804 wrote to memory of 3380	3804	msedge.exe	84
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3112	3804	msedge.exe	85
PID 3804 wrote to memory of 3524	3804	msedge.exe	86
PID 3804 wrote to memory of 3524	3804	msedge.exe	86
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87
PID 3804 wrote to memory of 4024	3804	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\396b6809f5ee1d84bec40fd8a14b97cf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa439e46f8,0x7ffa439e4708,0x7ffa439e4718
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11718019253098550060,14117824758309887865,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,11718019253098550060,14117824758309887865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,11718019253098550060,14117824758309887865,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11718019253098550060,14117824758309887865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11718019253098550060,14117824758309887865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11718019253098550060,14117824758309887865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11718019253098550060,14117824758309887865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11718019253098550060,14117824758309887865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11718019253098550060,14117824758309887865,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11718019253098550060,14117824758309887865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11718019253098550060,14117824758309887865,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11718019253098550060,14117824758309887865,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e05ce3b59f172cfe9160586e611bdcc4

SHA1
5888d3830647600e1a67dbcc3aa51a6968d8757f

SHA256
2ef3afe0a625f155bb5bbe3b0a4f504f48839fd5e15883809c494c6af3723325

SHA512
57a0ccb86cdf7e0df961569e783ba507877bdc1d18b97f4f40f46c128e14e369a64b2a149c79a7b378c9ed354c127d578af745cc82a8832ad0d96f1147076077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33cbdf7b5a7b0df98fa5e46f8bed01f5

SHA1
12bb4a5cab016bd5afc0a94cc40f48d25b6696a5

SHA256
47c0c4fc4784015710a2ca025c9e528af5aeb1e0350dcbef35424bf612f23585

SHA512
74e5fcbce93db622089cbc0354077dd9719be9a12fdece1bea8bef5294b8823963417ba364f7470a15c28a987e5e28393f79f88505835ed5c6c2dfbcb6dc23eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
541e7e077ef57eda6a005f636177bff7

SHA1
f959ef8330b99e40cee46b06a602315416b7b2aa

SHA256
6e1773c1d98f9607cd0df24ba7dbca1f4a07c158fb6f52db6a1c86f540bd2d49

SHA512
448b96a5dc7ca1abd115711c59a56aa3c3aa04df98c9dad97b133b5683dae2c43d9ef0131a7ba4c413c608157f012a3cf506abdb941613305a4dbcaf348e32c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
230605ac9832fbe25ac15618cc446aa1

SHA1
9bc271614783a84d588da8263549047aa0b86561

SHA256
bfef59ffcdb16aad1d39db8af6626c8d6db07d5fc6824fbcfbce62c71eacf942

SHA512
622b2571a329439bd71dfabdf162ce2bf4286f0df3b03f045811ba58eb6612e87eab967238fcb51f6c3f5951beb89e9ed443ee36d4947bd1460495dc3314e3ba

Download Submit