a1cacbb4c5a0a8fa758a9beec70996877abcf6f8059ae40a93270b145184a031

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ebbeb87483e7deff23e9ec1604c988d_JaffaCakes118.html
Size

18KB
MD5

3ebbeb87483e7deff23e9ec1604c988d
SHA1

d5462536dd8ec0acd794a85966de025257c84f20
SHA256

a1cacbb4c5a0a8fa758a9beec70996877abcf6f8059ae40a93270b145184a031
SHA512

14979c59e5b57e1b5b4fc2e6adb165877aab8b5d9625e244a70974c1d16e15417cee3fffa73eb65bc71feeaf2e7d0d918532358540107e7d27d6a4fec6014590
SSDEEP

384:SITpzKhyTR/ph2nF3vY3HgyFoQa4D/EGQP416mVb8bh:S6RzhWF/Y3AB4tUPmVbw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
4172	msedge.exe
4172	msedge.exe
4416	identity_helper.exe
4416	identity_helper.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 5032	4172	msedge.exe	82
PID 4172 wrote to memory of 5032	4172	msedge.exe	82
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 2616	4172	msedge.exe	83
PID 4172 wrote to memory of 380	4172	msedge.exe	84
PID 4172 wrote to memory of 380	4172	msedge.exe	84
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85
PID 4172 wrote to memory of 4748	4172	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3ebbeb87483e7deff23e9ec1604c988d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb44b146f8,0x7ffb44b14708,0x7ffb44b14718
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1524,2672490612655159892,10246273374936752613,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1524,2672490612655159892,10246273374936752613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1524,2672490612655159892,10246273374936752613,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1524,2672490612655159892,10246273374936752613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1524,2672490612655159892,10246273374936752613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1524,2672490612655159892,10246273374936752613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1524,2672490612655159892,10246273374936752613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1524,2672490612655159892,10246273374936752613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1524,2672490612655159892,10246273374936752613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1524,2672490612655159892,10246273374936752613,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1524,2672490612655159892,10246273374936752613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1524,2672490612655159892,10246273374936752613,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1524,2672490612655159892,10246273374936752613,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
36b70e3d5cabe895ebd27c39e495d71a

SHA1
f96da40ad7dc22d37570810f8cb35bb4b46ccaa5

SHA256
a4fbfca9d2b3ad4a1c210a06916b0bca1469798c9602313c5e9f65f1ee03f6d7

SHA512
5c8f4aa30dca04cd8320fb773e755f54a61e13552a1e8a5e85789664acf1f661927de64c4b12ca6bc43b5862cb243cb7739e4275577a942535a4a2f85d466f23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df937cf7ba579dec380c6ae3cc81b018

SHA1
675a255c0d875777cfce0522e31359ab55abe8cf

SHA256
2ecadc7dff875f28d6c41ed6a5a37fff1483e50e80978e0c049860f918f414a4

SHA512
4b1ae3edb7d98b3f426a8e14c13eb47900001584ef8faaf2d6f8ef5e7e0a926888d0d7cf4567f5b4b39a739120c89f5cca7701d50ebee1ad2cdf7dd66a64752e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0341d02d84fc8fcfe7a34214543a7ff6

SHA1
e49204b553287d890e1110a35623e255d3329a36

SHA256
c549f983f1b18729bf4e5bf984dc4d8096d64a29e7242d2cdee0d2805fcb59fd

SHA512
2a3ec762ea140b846b5d2951346f9b1aac5189006774cf2800c76e364174a6668760b0cca666091e7c9f5ca0c914b5cf1eef4292794ed521444ce3ffe514cd3d

Download Submit