2ba710d7b6752d775b9e11f15b066f315bcfbf96ae1d88643f303b0035cd5b1a

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7209bbdb457d5f3069e414ac1250ac7e_JaffaCakes118.html
Size

773B
MD5

7209bbdb457d5f3069e414ac1250ac7e
SHA1

80fe5e971d7a77adfe036c35e7502cc374199424
SHA256

2ba710d7b6752d775b9e11f15b066f315bcfbf96ae1d88643f303b0035cd5b1a
SHA512

69607d14210c647be447b6d31ceded124e96fb09e2b07f39a0cae7dd96c603312efe0ad91f98051f5514edb9b16df8779848f47d6ef28dcbd07a1567f2354e07

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
1020	msedge.exe
1020	msedge.exe
3056	identity_helper.exe
3056	identity_helper.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 4736	1020	msedge.exe	84
PID 1020 wrote to memory of 4736	1020	msedge.exe	84
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 1344	1020	msedge.exe	88
PID 1020 wrote to memory of 2992	1020	msedge.exe	89
PID 1020 wrote to memory of 2992	1020	msedge.exe	89
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90
PID 1020 wrote to memory of 4464	1020	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7209bbdb457d5f3069e414ac1250ac7e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5a3e46f8,0x7ffe5a3e4708,0x7ffe5a3e4718
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4015311530200511017,7845066440835191288,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4015311530200511017,7845066440835191288,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4015311530200511017,7845066440835191288,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4015311530200511017,7845066440835191288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4015311530200511017,7845066440835191288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4015311530200511017,7845066440835191288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4015311530200511017,7845066440835191288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4015311530200511017,7845066440835191288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4015311530200511017,7845066440835191288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4015311530200511017,7845066440835191288,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4015311530200511017,7845066440835191288,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4015311530200511017,7845066440835191288,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4015311530200511017,7845066440835191288,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4015311530200511017,7845066440835191288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4015311530200511017,7845066440835191288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1872 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4015311530200511017,7845066440835191288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4015311530200511017,7845066440835191288,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5240 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6afd73b427ac5e299f0e4c4e6ca35ad5

SHA1
323c8e29c344a74d8210628644dffe6a33e7583a

SHA256
95dc4fe0a19df8bac0aa06e1fec4edc1b22993b1c8ac799a14620af0160aaff1

SHA512
0a72830c1ccf2cfbc0a3559ec8e33e095a699d3ec958587189716e854aa4aa557c2bb5b4bbc3646ea2ff26c356b801d984dd82d8984914fc560f6bea9d16b5a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
756433194cf49b024063b59a349fa5ce

SHA1
8921b5351abfab3c0bdac4290dbd43119b392c06

SHA256
06fa19628740a14e915990f1dbddef2da8b8d2f394c3d46e8e5f26d856982bff

SHA512
a126d88904797143b06a4feb103ed6edb294e5a5a09b0fd69d64ae9fc3e8c062d52bf4ce7546ff767fff3f382936e997527ccc59b036f16da0393931bda89b3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7eed7c3b5230704243d274c295787964

SHA1
44d6b60d9ed57cef61c50c6c9e0a4d7f965ebde7

SHA256
e9338d89462f3115aefba0030e57ed5d18e9787d9a65e7b96949905e1c49500e

SHA512
d67a397cd9649512dea4906cc7ff29de78cce04bcd43a371a72f36df40c04b148ab59eb72fb7b51263d4db7b6825f97f605b61028fe20d33c3a86f72ac21ef84

Download Submit