fc99da3f64af2c8da62bf919ac3c8981130208dbfa7c3cf66e4f583afaf45de1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 07:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4512dda763a0d969aa57c0fff12cf13d_JaffaCakes118.html
Size

23KB
MD5

4512dda763a0d969aa57c0fff12cf13d
SHA1

bd0ad983d0082982cad3f2e7b9f5c767f70aba2e
SHA256

fc99da3f64af2c8da62bf919ac3c8981130208dbfa7c3cf66e4f583afaf45de1
SHA512

d105e012630375c33cd0352979360052c1150e993e5db2a77cf0afbf96a6bbb83e7a5ac8356a238cb814b868f8dff685ed39c0c2c54aa912fcc1e6797c7507d9
SSDEEP

192:N+So2Vrb5nInQjLntQ/DnQieTnQnQOkrnt5qnQTbnSnQkanQt4MRnFnQ7XnlnQTC:USoQJQ/eX

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
1768	msedge.exe
1768	msedge.exe
4792	identity_helper.exe
4792	identity_helper.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 5016	1768	msedge.exe	82
PID 1768 wrote to memory of 5016	1768	msedge.exe	82
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 4428	1768	msedge.exe	83
PID 1768 wrote to memory of 2636	1768	msedge.exe	84
PID 1768 wrote to memory of 2636	1768	msedge.exe	84
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85
PID 1768 wrote to memory of 2860	1768	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4512dda763a0d969aa57c0fff12cf13d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8591c46f8,0x7ff8591c4708,0x7ff8591c4718
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8162847577954983275,11356812235177526928,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,8162847577954983275,11356812235177526928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,8162847577954983275,11356812235177526928,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8162847577954983275,11356812235177526928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8162847577954983275,11356812235177526928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,8162847577954983275,11356812235177526928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,8162847577954983275,11356812235177526928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8162847577954983275,11356812235177526928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8162847577954983275,11356812235177526928,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8162847577954983275,11356812235177526928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8162847577954983275,11356812235177526928,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8162847577954983275,11356812235177526928,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5244 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79b6937f8320ca755d4812e4045e02a2

SHA1
1e78f01b35b0a04baac19f0081dd633dc41c2285

SHA256
3ef68689ce97baec1e5324613cb681800b289261bd69c7589be852ef3346749f

SHA512
e87d159975b4fcc23a80f03945fe893e66222ad243d6491e98545c5db329a579b5b2ce34f88f0bf772d3fc02a138a0b5d017ab88f4f7ae586431b8cdd3869ed7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1635082d6a7d7c77ecbda74396801e0

SHA1
37d3a8c24ed654a8511a89d5ed9a80635ce91f5f

SHA256
ee40fc9d37022a940b037c1bc0737a586c262d2684f69d7ca4cec3af74ea7fec

SHA512
da3f5718428f5aad7cecf7debba432612e8e6eb49b42a1c8f8b90f9eae27dbafcfe7b1c0ef3f76f9c8ab545679f0c63673f37332a4863bdd50166de946ff6f19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
70769e7f9c399d1af1b04ccb29791e83

SHA1
e4c3eb34934bc748dc938f7eeaaa7064cc43183c

SHA256
e79db4bc11dd6f80a5e496737bb109be5e1f74606b9bdd34ec56b0c27931917c

SHA512
06a48c3084d8b4f33c30063442ac887a87f1a517704da8dd9f1f8da8dcb87e42c6f18b2c636cf7635cef7b034d7bf7db323d15c4f4403eb5aacc72687099af5c

Download Submit