bc843cde7c959e4ed2a08d139cd33874ebe785beea1d16d955cd6c82a43b4b7a

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 21:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

48097f70bc956c2dc40b2e4241585a17_JaffaCakes118.html
Size

43KB
MD5

48097f70bc956c2dc40b2e4241585a17
SHA1

a63cd465367b9a2b1a24b0ef0e0daf9f4a1926bf
SHA256

bc843cde7c959e4ed2a08d139cd33874ebe785beea1d16d955cd6c82a43b4b7a
SHA512

3cf722661e3880683a1ef3b0c52545fae68d06f8b91321799b2934cc7d6d5fee8b8c9eea3384ad8d19a4273895df44193626d44e9c25d9616fbc63c5c0ff9896
SSDEEP

768:3bIULQH7vfM8It6B70RpRypFCKC6qiW2WZCBicGgRxK7O6e9qVq8Wz/xyqmRt7fU:2bvtzxAD7fqV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
4296	msedge.exe
4296	msedge.exe
3880	identity_helper.exe
3880	identity_helper.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 4540	4296	msedge.exe	83
PID 4296 wrote to memory of 4540	4296	msedge.exe	83
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 4012	4296	msedge.exe	84
PID 4296 wrote to memory of 2368	4296	msedge.exe	85
PID 4296 wrote to memory of 2368	4296	msedge.exe	85
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86
PID 4296 wrote to memory of 3740	4296	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\48097f70bc956c2dc40b2e4241585a17_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7fff6dc846f8,0x7fff6dc84708,0x7fff6dc84718
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1939398909443145190,7015247174061218024,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,1939398909443145190,7015247174061218024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,1939398909443145190,7015247174061218024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1939398909443145190,7015247174061218024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1939398909443145190,7015247174061218024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1939398909443145190,7015247174061218024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1939398909443145190,7015247174061218024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,1939398909443145190,7015247174061218024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,1939398909443145190,7015247174061218024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1939398909443145190,7015247174061218024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1939398909443145190,7015247174061218024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1939398909443145190,7015247174061218024,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
858B

MD5
5f986173c19db5be315e4ffaaaa02d9a

SHA1
3a976f3ce28b7d653198118932b68ea8a3e872e7

SHA256
491eb6bf1d9fd951b6cc2d73a15413d38b1ffa3944ff9f220b3c06dcc331ee49

SHA512
a9eef91e9d25abad5250ac02b117470297128b2d9345d8fe8551e2eab2e91b907d8cbc0891baff435f5029fdd31f2eade3d141b76f9bc023a025b57796002a7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8eb476b6acdddad4762088fff4145877

SHA1
39e88bda2a0ac303491f22e3b9831e6149616b3c

SHA256
7d6808e518a6ebcfa3cb66af8d779a534b0918ffb51a407c2d8fa45d136e38ba

SHA512
7cf05aaf049da641806aeb826356669958313a5ccdd510affa59133a76731a490d93121a7b88b9ba7aa0e54eb3d2088c6d43721f211a21492799fc3f71078506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d09f4e8be13205150a68e3ecdc9b1718

SHA1
366aaf1c567413a04dfe56963e211208784c707d

SHA256
af5bec6b068136a8219dd37bc4445f208d20ed950f72e66a6ee477245c594d43

SHA512
f7232c7200eec087e27c0dcb1982034932631560d440bd90d3dbfb73bf40adb1c8ddb835b7e2c70700acfd07943add32cf3d8c58d11c2bf7f2ef212315143b4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
858508121240b2e275ca684532d1e8aa

SHA1
09c8b95c1c18ea6e6875dc5e10135528c7688c2b

SHA256
0c3ac191abfcd8ff7ad876d90af234d7cc5d1282fff2e432427b63dd81c73682

SHA512
1fbb146af6cffceaa78990de3c8b0b340d2fc67a3a60078d5def49507249cdcd649b69e1023f693dcee73ef100f4918e3e620df420014904e46b4dcabca8b06c

Download Submit