39471ff83d941571514aef3a429550e83c316dc922bbda31f9b7ef03419e2ac5

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 06:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

69fb90c01220713b5c1dd330c6a82722_JaffaCakes118.html
Size

1KB
MD5

69fb90c01220713b5c1dd330c6a82722
SHA1

4360d8b4eefc12570727ec26c51d75611c84655b
SHA256

39471ff83d941571514aef3a429550e83c316dc922bbda31f9b7ef03419e2ac5
SHA512

fde322f481570be43221c69e1f24fbb82c22674c685c2266ba998d939704cf38496e022a489e8d8e4b541caeea50ece0d3635d40174ad1167bbe1694840b13ec

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
4564	msedge.exe
4564	msedge.exe
2732	identity_helper.exe
2732	identity_helper.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 1376	4564	msedge.exe	84
PID 4564 wrote to memory of 1376	4564	msedge.exe	84
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 1712	4564	msedge.exe	85
PID 4564 wrote to memory of 5072	4564	msedge.exe	86
PID 4564 wrote to memory of 5072	4564	msedge.exe	86
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87
PID 4564 wrote to memory of 2128	4564	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69fb90c01220713b5c1dd330c6a82722_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85efe46f8,0x7ff85efe4708,0x7ff85efe4718
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,266624922613408568,3871774262874208025,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,266624922613408568,3871774262874208025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,266624922613408568,3871774262874208025,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,266624922613408568,3871774262874208025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,266624922613408568,3871774262874208025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,266624922613408568,3871774262874208025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,266624922613408568,3871774262874208025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,266624922613408568,3871774262874208025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,266624922613408568,3871774262874208025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,266624922613408568,3871774262874208025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,266624922613408568,3871774262874208025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,266624922613408568,3871774262874208025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,266624922613408568,3871774262874208025,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2588 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
d862803be2fbb19f15b7aeb5f6034c28

SHA1
658e05b573e72e9d988991fded9ad0d520258c81

SHA256
b3a83ed7c1d53c60df116ba4d1202d80204232cd100f2c2f100a0d44ee91efa5

SHA512
248adb591d21fe3a4c7735b0bd022f148d1cc4fb8df3224ab23588747562927f3a18e436c2f8b238c4ffab8d727aefd9e609fefbe9411002c8199afe93935967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
403B

MD5
1a0eb4bf7dc2d5a8ed7cf99d37c901dd

SHA1
3da9f6d4e7d8e68f65ccd9927a9d3afa1f171395

SHA256
46f424473786137a7885e85d234db994285eeba86f859746dff09c1f8ff50479

SHA512
e8bd0cb497e7d8475005ed068e01ddd08ebd4d45557edec4a7224754a60d9138ce8e5e59af184df279062d239bd4ec8cee48d65638384031cb63061367a28579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a0b53b9aa3c2aac9fc4c0e687f57d1b8

SHA1
008399763f041e9154d56ee972f27fbbde557fe4

SHA256
8e019073e2fd683ab41c1195aa0c771b0082ac6f4c1b6aabbd44cbd9ed9fec62

SHA512
22329291bcdba85cf698a6312a0162a9d7ec48ee5b1614689fce0793c93f2b25e9df9920db670f0395f6622331e576da8dfd7eeae961d6520d101dde72f309e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
225e1a5b7b556ceb11bcbe7dd26aedfe

SHA1
dbb04aabdbf8101ee46e8b19d8aeb128bce0aab3

SHA256
1084a3ccf27726cc112b807b21ee3c3dbb7e9304f275f1dfb6172f59dc9272f6

SHA512
1a073e8232b7e942186a7dddd5932599db6a99a5a623b0c5bb97a8b188c2c04f8d96e46c08dd423caa69348484df0c36bb9ce1f00d3d6692f6c6f31f093d3f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bc9684bc0a2cacba1d6a6999bbad74e7

SHA1
755711474332b1c0cfa82353dcf2af2e9b12755e

SHA256
077039cc394b7a18d69db5e5c1235b841cd3bd4bf8fb5bfd371f9c26794cbee2

SHA512
0b697d96945d6b122a91639e62a341850230fa9fc2fc7b0e55f5851c672044d71f57ba83d77ea4bcd4dc2c45df6c7632c49bfdec4b27cd431fb6fc4fe443cb68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
36838f8f357977957e2bd5c1e8b44323

SHA1
66ccfb09ed90f1969042d369c59857bcc7c3c221

SHA256
00e21a55b9b541a2452812593fe2b90b663a7491632231ae0dfdb75cb9a27e23

SHA512
3aefa544aee4cb96ce09953a5eec82a9a73ae961d1fa7caddd3c66be47867ef91f198674702204528bd0bc4d628e7f3a05787b3431e0485aa4747779fb16ae51

Download Submit