719496a9ce6495315a7764f2ce0edc47484e1b64da9984f110b5e485fa17d4ba

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4da80e8dd246da02a2e72f5226a1305a_JaffaCakes118.html
Size

325KB
MD5

4da80e8dd246da02a2e72f5226a1305a
SHA1

f0b08d87f8f9fde67ccff6157bb4bdbddb2279d1
SHA256

719496a9ce6495315a7764f2ce0edc47484e1b64da9984f110b5e485fa17d4ba
SHA512

0d420c6bba1694cd0bddaaeab63f7ee035fafce81bd76963a18feca871838efa68b981209d1bf77aabe87a44de94f63b881e6a1df0ee4f4e6a48cd53aba1298e
SSDEEP

3072:Y/8JPaXdkqxqd85j6JwawzgKIG2VLKpYtAgOlMccGxCARBGdCm+8dCrh2T8uWMR7:t49u2qZZL8Nck8Eh2o0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe
816	msedge.exe
816	msedge.exe
4760	identity_helper.exe
4760	identity_helper.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2884	816	msedge.exe	85
PID 816 wrote to memory of 2884	816	msedge.exe	85
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 1988	816	msedge.exe	86
PID 816 wrote to memory of 3824	816	msedge.exe	87
PID 816 wrote to memory of 3824	816	msedge.exe	87
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88
PID 816 wrote to memory of 2244	816	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4da80e8dd246da02a2e72f5226a1305a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcca3d46f8,0x7ffcca3d4708,0x7ffcca3d4718
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1824,17783328650639954183,13043482114480252225,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1824,17783328650639954183,13043482114480252225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1824,17783328650639954183,13043482114480252225,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,17783328650639954183,13043482114480252225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,17783328650639954183,13043482114480252225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,17783328650639954183,13043482114480252225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,17783328650639954183,13043482114480252225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1824,17783328650639954183,13043482114480252225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1824,17783328650639954183,13043482114480252225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,17783328650639954183,13043482114480252225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,17783328650639954183,13043482114480252225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1824,17783328650639954183,13043482114480252225,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
954B

MD5
8f25bace940c487eec9c4f4092cd476b

SHA1
6dcd3c886b21a096296c3ddde681ca599d2e1dd2

SHA256
23826ee50f7bb854142f8f22bc313bf45827ce107e1f2a274d4ad201ffaa50b9

SHA512
82eac55a72878bdcc695806ed67c9c4ebb44dfc666b9e8ce10d4cd3937eb68daf5f4262accad8047bdc6521ac052429e72fbf2f27966c99e805279c37f242d7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f63e557090b22b7f51241eed248c3c87

SHA1
18f324af805814c79e3d5b28781b174097f5e02b

SHA256
5976ecc1edb151670cde58ddecef6cc540d5ea8bc5047cffb7c80f22b70ef3d1

SHA512
46b7950f7f9b1efe8f8d6b98f25ff34d28ae620d228ec6b716e270c5ebaeb4bbaabf31639a31a0963a9ad19b00402861119bdbcf8e964f8b0bbfa4c6a98c54ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
32393ece28be37f1a867f1dc17af6e16

SHA1
0281012a69fcefbd8c9b4f237e235adc67365e7f

SHA256
e907ba49aeeb5094e5f79aa2ea4ccd192982b28a3c10648a0e005a3258e9fa32

SHA512
7d01adfb89e45e351d345d14b793fa18ce7e177c345e5bb579c5fa64cae51bea39d3c9dcfa9dd4c8eb2dc6e6b5b8094d90157d27fca260ace5b93dbc1dc3a1a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
bf7c35d716a495edcf44baba2e03ad9d

SHA1
86d64cf7f659370b839667a384999a5a9c3282fd

SHA256
ecf5a95fb2cbbee1995a52edeb57468e585c2c533f13ae6d0df7046d3ef38a4e

SHA512
3244aa6d293538bdedceddbaa86c1200fdc0c203ef9f87e8e41209a89681f66cf4b0db0f77d9333346c8f0350b256bcab0a6f6b828af9176e2c1ce2d462cd373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ce7b.TMP

Filesize
538B

MD5
3961ada82576ccf141b97c48ede1bcaf

SHA1
6fbda93bb91abb0e1acc715386184a4c4e008fb2

SHA256
18ac3f162735a5f487227b9e470dbfd9d164b66500e57ee8825d0b8870593b22

SHA512
5abd654b69432e772873ea5454a134bacd99740e3b6558a787cb6ccf9c45cb350dd583546280553314722e45f195068e8d38698d1fd0aa738ee6b103b9f093dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fb43ac95fc0da12234edc1831a5f633c

SHA1
7e61551c2e8cebde7b5a4283093375edad7321c8

SHA256
fa3a3322b05d60584e8a4e753305fe8939e4607bd274ae41e9c3296e09a88771

SHA512
e834ccfaa260b76ee6287635baeda64672aedfcbbb6413ff8fbf9136de01ebcd15cfa075df1ddec09173fc9c2dfff74b14b9935e2b03dfec7aa63933e3b01512

Download Submit