c2def8d33948506b4ae6ff32c614b872fa741fc550ef9e7ad0af6bb55057cc39

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 00:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c3403193038ac6307d1a2e514dee6d6_JaffaCakes118.html
Size

57KB
MD5

5c3403193038ac6307d1a2e514dee6d6
SHA1

d292d7aaeff762a064759d9f6af4aac454a6837e
SHA256

c2def8d33948506b4ae6ff32c614b872fa741fc550ef9e7ad0af6bb55057cc39
SHA512

e1a51d75e9f0c500c469f868cd6d93f12086d8115929147a93ed2d76a9b96f2eddd6df024bc397f569fd12d37e742024dc1acb1377f5e1e7979e8b451857e3d3
SSDEEP

1536:1STDbwmZ3vdBZollfa4eiGrYxwOMXUoEEovNwzxSIeQxNJ41P1ga/:1S5VvdBZollC9iGrY5EOP1ga/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2264	msedge.exe
2264	msedge.exe
1892	msedge.exe
1892	msedge.exe
4140	identity_helper.exe
4140	identity_helper.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2532	1892	msedge.exe	83
PID 1892 wrote to memory of 2532	1892	msedge.exe	83
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 3940	1892	msedge.exe	84
PID 1892 wrote to memory of 2264	1892	msedge.exe	85
PID 1892 wrote to memory of 2264	1892	msedge.exe	85
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86
PID 1892 wrote to memory of 640	1892	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5c3403193038ac6307d1a2e514dee6d6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc2ac46f8,0x7ffdc2ac4708,0x7ffdc2ac4718
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9872494905913444660,8563942113762905411,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9872494905913444660,8563942113762905411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9872494905913444660,8563942113762905411,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9872494905913444660,8563942113762905411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9872494905913444660,8563942113762905411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9872494905913444660,8563942113762905411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9872494905913444660,8563942113762905411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9872494905913444660,8563942113762905411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9872494905913444660,8563942113762905411,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9872494905913444660,8563942113762905411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9872494905913444660,8563942113762905411,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9872494905913444660,8563942113762905411,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1464 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\98f52720-e83b-433d-8f36-362a46f41b8d.tmp

Filesize
5KB

MD5
e41b31cc80fd0755c016d33297653196

SHA1
ad9a5888c68be2ceec6fdc0b82523df9f4297814

SHA256
cbd09973f26908c2bea341da907b62dd5740cf04ed33b32eba8c1adbd2ff28c8

SHA512
859ee7b63555436b80af940b2184ce448ca66aaa5ab335485044b2204bf3b2b6aa782405edb33b2b48c98db5877dcf1ba9bcf1820f5f123e86ae24ca00180ba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
177B

MD5
af208c6bb14127eea0541bed38bd0a06

SHA1
c5f4da6f0726b3f85cd81f2b4ec5aade4915baa9

SHA256
fdc65b15d14ebfe8c39ae462afbdd24f95e471d3d72c93e1bd71b64dc5c46c42

SHA512
d6fa99f77819d99a717d9a107004562136d4fe4cb5e3f045c317a87419e93be2b4f630f53165d3ea508cf18eed04a88fa527cb78bb82f71bd3740e1e032b7727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19300e9fa155a29821a138946a458af2

SHA1
3fc9451e7e13df176189795b572d0da7a4b8b4f2

SHA256
0c8f22a3fae2e2a4fc1d80d9ed84f6826a71c229c8f108c1e6c5beb9f568277a

SHA512
5536a35752df75c6e62fee3f31d408b65031a227912d24c713a88768206cd68dbec5f292d7f07cc435e335a5fbdab7b6e9e7cc29bfcd9306f1088b341e4935d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
50a4fc684f13f91ac237f22cdcaf9ca4

SHA1
5ae0acb8232a1e3a38a0ccac4ca300e3fd4e6c96

SHA256
4acc9ef9f199b688e939f77e794e1fbef21007600ed31f41cc324b457ef4010d

SHA512
98680a62e3c966ac68fcc48a3fe739a8931d5342c7339d858dff9d53cb5bb081106161c8c5dc06f4807077363c8299607242cb076728448b0a6aa4e29d5fff3d

Download Submit