f7ae010b904ed18699ff157496ede07c92cec60f9ff46c7f23116fcd6cb28fda

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

41224bf102df37c811bfecdf096a9052_JaffaCakes118.html
Size

103KB
MD5

41224bf102df37c811bfecdf096a9052
SHA1

3b1a5fa995e040ee2e75095904cacc95507eff48
SHA256

f7ae010b904ed18699ff157496ede07c92cec60f9ff46c7f23116fcd6cb28fda
SHA512

a60d451707091eb841e47f2dac0ce392360fdc75ca6eecedb650e9c6c6a9428380b462c2245024f6b489a770d9f566eb56480efeb98a309964e91808986bdb52
SSDEEP

1536:2Gb/G+/i8JRB8WYi231BZGhqN3wtVSmUnrXNvP0T8wH5zpAmtlAgE:2Gb/w8A1BZG3UnrXN3AtBAgE

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
2420	msedge.exe
2420	msedge.exe
2916	identity_helper.exe
2916	identity_helper.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2044	2420	msedge.exe	83
PID 2420 wrote to memory of 2044	2420	msedge.exe	83
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4740	2420	msedge.exe	84
PID 2420 wrote to memory of 4760	2420	msedge.exe	85
PID 2420 wrote to memory of 4760	2420	msedge.exe	85
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86
PID 2420 wrote to memory of 5020	2420	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\41224bf102df37c811bfecdf096a9052_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe344246f8,0x7ffe34424708,0x7ffe34424718
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13052006430980274534,483455366150291264,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,13052006430980274534,483455366150291264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,13052006430980274534,483455366150291264,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13052006430980274534,483455366150291264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13052006430980274534,483455366150291264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13052006430980274534,483455366150291264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13052006430980274534,483455366150291264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13052006430980274534,483455366150291264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13052006430980274534,483455366150291264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13052006430980274534,483455366150291264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13052006430980274534,483455366150291264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13052006430980274534,483455366150291264,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1e2698dbae5dc5f315e40dcd0ed5d612

SHA1
b75ffe4721ee6751e293d021e5b3abe6d72899dc

SHA256
a89660c3dbdda61866a4752f63b5e2829e9349f3c7309c07a498575d5013f0e5

SHA512
4470a9579ace926c88ab8ce6b658646a9c1bd6f3296ff4c926971950588a27d1928a0379189b9335c87392472b7651ca6437e301623f83d0e819e916d5e4eb70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc7263fc10836e1b5c343f87bf914d36

SHA1
3a2e0a4473d9fd753121e5fdce2561d351a64a72

SHA256
b8932d1f437e8c3b7bcba38f964366178a2bb2dcd0576a86539ca11fa20f9eec

SHA512
def33f99b7b2bca6277e545a67a2aca65cb7b3befeb4bf9a67a8a50dc242b34a605ae6c5885018c3ffaa37bb58fd059e34f0da95f500b2b1cbb0deca3f139b93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c4bd67e0ae761f39220d5f46643c8633

SHA1
7cc236dcf9dcc0f2e4632c0cf9ae5d7ab8daefa4

SHA256
a58aa319a1ff2ef6cb187c508aaecae00bbc1aa78191b0de2a780d4f90731e24

SHA512
7a43c92de904f00d5cda24506076136c333a80bf03b7794a5ceda4a0f7809386e51caf180c9f7dc0a46d0fa4b6c0c624d66e691c0efbb971518adba6e7c7c247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
77ac6ace7b2e5be627fc9e333c1eb14d

SHA1
4cddeb99388b3b1d3907dcd6f3483f56660588ce

SHA256
67fe7c32a1613fbe735502b83483d0956d047979091f7f8d70973a72f89e398c

SHA512
9832243d68080b9525f2a3e07d8d3167b8311783f0228701526b08cb63c68a0b14aa4eb2343f74d50c861db49fbe37236f022d19c533f45c5daca538cfd9f374

Download Submit