177f4d3a218f695db1d9812a68982409f361a60725a11fe3b1f5ea16fcbb1226

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3dc3ebb6a45be0bf327c2ea6c77e321a_JaffaCakes118.html
Size

27KB
MD5

3dc3ebb6a45be0bf327c2ea6c77e321a
SHA1

f9f3e09f7464c5e9a690b67547ca34a847f30b58
SHA256

177f4d3a218f695db1d9812a68982409f361a60725a11fe3b1f5ea16fcbb1226
SHA512

4fb718e09d6d57d83417e167b3749eef515f4b4ceb73df370a7093b39e9d7da89bf21d02e860fab8727aefa9608031e1d5e1ab66eb4563fb46ff8206acc90b40
SSDEEP

192:uw3Ab5n1WnQjxn5Q/UnQiePNnAnQOkEntsinQTbn5nQ9eDHm6lv1PQl7MBvqnYn0:cQ/Ki5N1OShaoo

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
700	msedge.exe
700	msedge.exe
924	identity_helper.exe
924	identity_helper.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 4036	700	msedge.exe	85
PID 700 wrote to memory of 4036	700	msedge.exe	85
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 3788	700	msedge.exe	87
PID 700 wrote to memory of 1536	700	msedge.exe	88
PID 700 wrote to memory of 1536	700	msedge.exe	88
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89
PID 700 wrote to memory of 4588	700	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3dc3ebb6a45be0bf327c2ea6c77e321a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x44,0x108,0x7ffc835446f8,0x7ffc83544708,0x7ffc83544718
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,9187400024350681524,14975346072222820470,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,9187400024350681524,14975346072222820470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,9187400024350681524,14975346072222820470,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,9187400024350681524,14975346072222820470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,9187400024350681524,14975346072222820470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,9187400024350681524,14975346072222820470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,9187400024350681524,14975346072222820470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,9187400024350681524,14975346072222820470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,9187400024350681524,14975346072222820470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,9187400024350681524,14975346072222820470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,9187400024350681524,14975346072222820470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,9187400024350681524,14975346072222820470,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a0c3a936316c021fef32e4932f2e31ad

SHA1
52c6d8f1870374aa350ecc7b54d7225773bb88ae

SHA256
3ece9bd9043f0e29da1f35ef211e1a49d28a13e88a41f4a988e366e0612573f2

SHA512
c95d3a47673a0181c31947bd3dac80dfea672b8118f83ef007b286a95853a387a017a3b432c88d8b380af0231d23eee9f3f3b5d00091ccd6f5747e3c77accb0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e750abbabba2a43100d59986f3528de

SHA1
d690d10b6af4690e8d4706f537e5e38102798861

SHA256
76cfb2c2f1ba4c751e2964be0a2d990389b58efd92c9cfc8451b7c6d999c31a9

SHA512
3447c83e9f86d76b5252d43081e0b24748802741f206ba638c7f34fea6cda535933660a0ce13dbc6cd161d1bfe6be16788c1980c6c1da70d3e2640cdb5231121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ce5f75cc-5b4a-4a36-98e7-83810adc05fe.tmp

Filesize
11KB

MD5
e9044087d5c40f4de572a9ca15570fdc

SHA1
a7e2461d619f63066f4ad78cf9a474d2bc76803c

SHA256
bc6e2eda8f13bfc79439d45c944de3992470ef3ff5b35997c564f34c75d1d13a

SHA512
95f05e2387dbdae952d1d745a8a74ace522b0a8a443f41d2430d6d87376ddf5a6405834f8f58b002b2532db281cf548a43bfaea56d98d65b51b70751cb205489

Download Submit