c804881e1a693c3efa7332bca5ab3a28fc58d349c5edeecf9f1b9399f55437a4

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4918eea8f21eadee4c24a3b59ba57a1b_JaffaCakes118.html
Size

461KB
MD5

4918eea8f21eadee4c24a3b59ba57a1b
SHA1

b34ee27d1dd05ec17ea6e04a0e02d265573519eb
SHA256

c804881e1a693c3efa7332bca5ab3a28fc58d349c5edeecf9f1b9399f55437a4
SHA512

2ac5ca0986bd1d8dfb707b90eb0ce73ebed130bf1f4da9a09ea3aab32a63b51f0fe215c78fe068d2800885bcc9c12400c7fbdec4cbdce93bdee69f4e1aa2434f
SSDEEP

6144:SfsMYod+X3oI+Y8sMYod+X3oI+YqsMYod+X3oI+YLsMYod+X3oI+YQ:w5d+X385d+X3+5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
2776	msedge.exe
2776	msedge.exe
2924	identity_helper.exe
2924	identity_helper.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 3964	2776	msedge.exe	85
PID 2776 wrote to memory of 3964	2776	msedge.exe	85
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 3572	2776	msedge.exe	86
PID 2776 wrote to memory of 4308	2776	msedge.exe	87
PID 2776 wrote to memory of 4308	2776	msedge.exe	87
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88
PID 2776 wrote to memory of 4780	2776	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4918eea8f21eadee4c24a3b59ba57a1b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe6c446f8,0x7ffbe6c44708,0x7ffbe6c44718
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6378124088028326835,14847751972352825660,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,6378124088028326835,14847751972352825660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,6378124088028326835,14847751972352825660,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6378124088028326835,14847751972352825660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6378124088028326835,14847751972352825660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6378124088028326835,14847751972352825660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6378124088028326835,14847751972352825660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6378124088028326835,14847751972352825660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6378124088028326835,14847751972352825660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6378124088028326835,14847751972352825660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6378124088028326835,14847751972352825660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6378124088028326835,14847751972352825660,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7bd0d9431229b2be5123ebbfc4502b9

SHA1
98154a5eb9c6be1e373aeb1eb351926204f89e33

SHA256
ce287f0f11dfd384c9a8abfe38f0a0aac772a0b9c03e4c9ef36960996b3c4638

SHA512
c558b6ade7ba2bf44d4d9e4c4bc3a422f4182c3d20c69b1e8384a6ad53f0376f188a315ad6a9ff9cfefc37f0ba1f205dce501bdc8be7f29549e6efb2474a81c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c316236f81dad551e3f7fb96df28e528

SHA1
cfc9eb2ee6cb09f61a0fb7ea26a3062426b2c825

SHA256
08b85f567d8164791e592b909bef38c39a3cd521a0f1062124663a5db7835b03

SHA512
e46e2ebe50c0fd8dc6c4ab58d87debc51c67804b5711491cc8b5ea4c8ef10cf02a079361a610785d791e2a4113f4ec69b9331701c21fe963c0571d9d2970d413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0fe15fa2aef4e65127f93596100c7c1c

SHA1
313c7a3de12ee2f42f9e0ae095715c2a25a565d8

SHA256
2295c14182dff6ecc0dc626d6029b79f18871983066a3ca6c8a8c1e3a6b42369

SHA512
f7c5a3bca598f42a1cfeed18eb99fb39a192f99092f2ba1a9a118e52d1e0ac27a35ba774832098c4cf0911cce146e50bb7c298a9d4689a193c36c2b03cf936e5

Download Submit