5f867ac0a597ccba8766430042b011f59eae545c2862f6c75d8c91033eae5c26

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63ade0114b82b94f9447ded4fcf3e2ba_JaffaCakes118.html
Size

36KB
MD5

63ade0114b82b94f9447ded4fcf3e2ba
SHA1

877c8006f87021383469a59b0abfa60c454704cc
SHA256

5f867ac0a597ccba8766430042b011f59eae545c2862f6c75d8c91033eae5c26
SHA512

9f3a4ee72956c5f0a3dc6acb49d89a7b2a5dceb89a8e63d40389259036aa861747ae6cf37a6c5424a1ca032185429e4fc6a237e8e1650d32c799aaee4fd72543
SSDEEP

768:zwx/MDTHuw88hARUZPXnE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6T8iX6DJtxo6qLRD:Q/rbJxNVEuxSx/d8hK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4764	msedge.exe
4764	msedge.exe
2992	msedge.exe
2992	msedge.exe
4900	identity_helper.exe
4900	identity_helper.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2992 msedge.exe
2992 msedge.exe
2992 msedge.exe
2992 msedge.exe
2992 msedge.exe
2992 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2992 wrote to memory of 1052	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 1052	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4568	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4764	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4764	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 3496	2992	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63ade0114b82b94f9447ded4fcf3e2ba_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c93a46f8,0x7ff8c93a4708,0x7ff8c93a4718
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14485742344950174934,6935123218709885293,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,14485742344950174934,6935123218709885293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,14485742344950174934,6935123218709885293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14485742344950174934,6935123218709885293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14485742344950174934,6935123218709885293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14485742344950174934,6935123218709885293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14485742344950174934,6935123218709885293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14485742344950174934,6935123218709885293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14485742344950174934,6935123218709885293,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14485742344950174934,6935123218709885293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14485742344950174934,6935123218709885293,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14485742344950174934,6935123218709885293,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1352 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
613B

MD5
649d7a33252fd146edcb0a279b5ae069

SHA1
a182c7b6f2a159a7e99dcfa6aa8da75f8a21b389

SHA256
342403192aa25e60445329ed13192d8046fd36723c931cf6b9827d4caa18484b

SHA512
02dcbf8bf5d6018f38b953fbdbcedc5864da240cdd7cae74cd8549ae3d7298d06697deee2fb32b0b79e676da1938f4c34ed80bee78d600a5e26cf105e61296cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3997cc60ba2e22eb4416b00ab14e46f4

SHA1
ae1ec2288c949abe3bff1ef80e5537bf92f49e63

SHA256
54b7aa1a197156ef349566c3e428d15e8a6ae196b7668aec5984c8dd1d5f9556

SHA512
6ce7b82d1cdad8b19dd1a66a576990538d9fe8abc89ff5b39a558d7c2ad6f35a11ef04f358f5717139097d6d6b3c3bad1f3a35a37a9ef55ee7c7a736dcf91f25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b4ce8d15b72de76e18c29bf15e74ea23

SHA1
d5c44f30660596ad6d776384e0a338d85b5d510a

SHA256
5fc5d638f1ca57d2cb9ce00240f7b07ca065f15f47bd43b47af803df254b5e53

SHA512
4682ac8418cc199d46720980fe66b9147cd551a80892fe3f0dc480f9d77a17ba8c0f53e6b8d4efc3fa6519e334dc11303739abfb141d2de3acdda75db4a728fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ff03b1a600188fc4a7365dabbaa0ff2d

SHA1
dcf666ae3ede85539beaccfb6967f87ca0d70d77

SHA256
35ca5b0d9763d6615697ec521dbf8ae34355da0c8f799e024b25e6e3c4d551c5

SHA512
55ce60d04c47aa1a9354a5ba6949d4d56d9256c48f3fe66628cef8b4bbf6bab3b00acaf3056c1d8438814ebd41fb79e655d0a8ce7a0c16e9d7da5b7eafc1cf25

Download Submit
\??\pipe\LOCAL\crashpad_2992_YNCRRSKMUIENVZWS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit