a620ebfb39eebc3d53dce37ed3a8602a51ac9cc83c8c0d2908dd469777c83fc2

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

496e1144bc8ad31190c38cea4374d45d_JaffaCakes118.html
Size

94KB
MD5

496e1144bc8ad31190c38cea4374d45d
SHA1

f9dfd0ee924771d3a3afa55ceaed244d19831d95
SHA256

a620ebfb39eebc3d53dce37ed3a8602a51ac9cc83c8c0d2908dd469777c83fc2
SHA512

09c8f5f4ab7c0473411f707e345694dbd136c860cb46a126eaf86135c1be11afd4c541ee12d05e579b3df4d2736cf94de1483660a74366a2ea80d036e25f2707
SSDEEP

1536:WMLiNoHda7LcfAC9FL6C4Df6+SJpIXr6ZJy68ghBdkrY8mgHC+qpEyW:WAiu7hBdkrY8mgHC+qpEyW

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
808	msedge.exe
808	msedge.exe
1504	msedge.exe
1504	msedge.exe
4504	identity_helper.exe
4504	identity_helper.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 232	1504	msedge.exe	83
PID 1504 wrote to memory of 232	1504	msedge.exe	83
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 1268	1504	msedge.exe	84
PID 1504 wrote to memory of 808	1504	msedge.exe	85
PID 1504 wrote to memory of 808	1504	msedge.exe	85
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86
PID 1504 wrote to memory of 3648	1504	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\496e1144bc8ad31190c38cea4374d45d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed41746f8,0x7ffed4174708,0x7ffed4174718
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10759656604711546206,16644360763811798692,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,10759656604711546206,16644360763811798692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,10759656604711546206,16644360763811798692,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10759656604711546206,16644360763811798692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10759656604711546206,16644360763811798692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,10759656604711546206,16644360763811798692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,10759656604711546206,16644360763811798692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10759656604711546206,16644360763811798692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10759656604711546206,16644360763811798692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10759656604711546206,16644360763811798692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10759656604711546206,16644360763811798692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10759656604711546206,16644360763811798692,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
178B

MD5
efb3e41ddcb00d4e436d59962fe73c4d

SHA1
4b9f2cbd664cf2136cd6966774f9ee04b4efa46a

SHA256
edc776d59064e412098066a07cba55cbabb1e7d18534e1292d34003961ad3bb6

SHA512
85a53139125a0e589b222ebee00d1c593eb24c8059b9f3f86196f8ef346cf7fc988493bb6f5cebf7aec2d0debc5017eff291b04e8aa37180d1ec5a6e2bb362ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d1d690fec60eff367021a2a3148989d1

SHA1
948033dc39098c5e630a136ec54c0fbcc2e1239f

SHA256
ebd378639d82f5174de6e25f1bf75de36ba71e920c0ef4486535cf95766b2b50

SHA512
c38fbb01b4e66fb61258e02a959191a015b33025f5df8e11cb7cacc6df91557a40f05ffebff2b02452e5f099173168e65f908878b80ef2069989f8de867fc274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97e4675a1aa597603f888c78c6f0f684

SHA1
5cd5cff1b31c47ef1a348e49045080f04b4eb4e2

SHA256
951ca6e0d420e893ba3132338d3038d76eec38f31045209b2c921e8c805eedb0

SHA512
819b6901e1dd45b9827d87915728419c2efb32a9c84b17877a92ab37838768c3e128b53e19e4ec462a587e7261e1d99a5620f63af23501a1c465967b81409cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97a082b7dde734e99f1f13d7e5266c6d

SHA1
3d962126dc78013e17eaf4abdca3b86d4a92df98

SHA256
39c8d0e659eef0ee653d8917dd1ea50b5baa5fd94a0580cdfba1eaa935244373

SHA512
0a7ffbc06bb02da841acc1c612b382ee5385a9bf42fced4be28cf9b1d6585d4867177c30223dfb82a87d550da7c329f0ca0e1ee998bdf2e49b834344713bc3b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f10c2a41d34e1dcda36fb08cc696a133

SHA1
b6eb3b5ba3558d64787ca50f3483e07b53881fb6

SHA256
dd8b4375e7cf157240eec11f6fd17ef7eedd1677497de588674f28d9ede2daad

SHA512
797ab6765ddbcd36b8af81d54e4dfd54c67b0b45b41406856f5ec9e72f6e2a87b109c82ce8456d774c3c73ab2906755cddb3299a17abc1c84b3ec5bf11a27408

Download Submit