d496ee01791ba8e0742c6ee747b5d6b58eb368dceaa81bf0b666e57fce2671ac

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a5b40afd567b3e4860d022be139cb64_JaffaCakes118.html
Size

37KB
MD5

4a5b40afd567b3e4860d022be139cb64
SHA1

69409ebe1fa46d728355d392a2fa85ccc1d5b8ce
SHA256

d496ee01791ba8e0742c6ee747b5d6b58eb368dceaa81bf0b666e57fce2671ac
SHA512

e9af5f3ef4555532dcb13d625dd88840bf6b3fcaf2be35f191e0b935de52e9a47d54c34c3c0183a6870400345016d81d802204a24c982124cb32e0d517c6854b
SSDEEP

768:SyKzC6CYCdC+CuCT227jKSK5e9slhgiI6c:SRnNq9Bc2De9Ghgi9c

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3480	msedge.exe
3480	msedge.exe
436	identity_helper.exe
436	identity_helper.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4968	3480	msedge.exe	83
PID 3480 wrote to memory of 4968	3480	msedge.exe	83
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 64	3480	msedge.exe	84
PID 3480 wrote to memory of 3892	3480	msedge.exe	85
PID 3480 wrote to memory of 3892	3480	msedge.exe	85
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86
PID 3480 wrote to memory of 3552	3480	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4a5b40afd567b3e4860d022be139cb64_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99cdf46f8,0x7ff99cdf4708,0x7ff99cdf4718
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7853828569729640253,3178534760694994039,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,7853828569729640253,3178534760694994039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,7853828569729640253,3178534760694994039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7853828569729640253,3178534760694994039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7853828569729640253,3178534760694994039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,7853828569729640253,3178534760694994039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,7853828569729640253,3178534760694994039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7853828569729640253,3178534760694994039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7853828569729640253,3178534760694994039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2196 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7853828569729640253,3178534760694994039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7853828569729640253,3178534760694994039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7853828569729640253,3178534760694994039,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f058ae25eba36ee748fd66bdb022990

SHA1
1081b914ef987bd39a8fc3cd7e251ddf6ed6cf94

SHA256
74ccf34b3744d065cb118463361885102245dd933ee784ad1aeb16a7a108effa

SHA512
5c0acad53151689a7eceeba3a0709c36c436739456d101dcfc906d20f992da28f10b309f444154d70f4b9c98fa746fa56ea6beb5216a39b48fcaea7c22f1f6f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5981ff163435ab975da3ba5719d5e509

SHA1
43a7b85660796a5abbef7fc0e0de58dd59dd1f72

SHA256
3780e036f5ac3448c3d6ce2e03607041b5860449f59a33cc6934b7b2e3a85c78

SHA512
e18c6812a7e0e0b2e778e51f41e7cf9f1bf5f94169266d8b9b9640bf5c2c025eadbe90f421ac30b9c447bed142a77b55b2d4f3bd50597895c9569fba4437b4f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc0ca0b4e95b29ebc53c4da99a9d5e03

SHA1
66b715953cb7ac999fe8a9057b975d574cdd2756

SHA256
bf23fa7ca4e1f9694ece2471c8208f18247fec688b2dd9b5ea14336f2ef1c352

SHA512
2cc2a2b481f73fae84e691a05a068eff8f78e762eb9dd8e6da7bd2d72709d8b64466802af0e1af500f8679fecb93b46267ec2af9dfe5831640a4682513d79412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f1d382e64792049eb3a05f5e6fc7dd2e

SHA1
c279f4a52cf0010061d923f364a8a7667008fb72

SHA256
c24b036b8efd17b236e7caabc0e025165ff4d8dcda6964a570b08560c6019b73

SHA512
43bb2f2b8d00262f295c49b3ac2f3bd411e2699053dcc23f4d82833fc8582d55606ca1a10954a66ab34f663793a260f33a0be7e18752be2c20377b2f6c76124d

Download Submit