d9e0f8feaa9723e16fbbdea70341d0b73bc3d3e2d73a4ba26d54e8764ddcf587

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

74a66561cd98e784367f8516eac2bf9a_JaffaCakes118.html
Size

230KB
MD5

74a66561cd98e784367f8516eac2bf9a
SHA1

8a273c880f71069bc696d19d7b9b14c964a15e49
SHA256

d9e0f8feaa9723e16fbbdea70341d0b73bc3d3e2d73a4ba26d54e8764ddcf587
SHA512

2602310a6e920348155d64d7179dd9230fe40cdf9d64e1b10022b3598ed01c2298e3d92997e4c43688c6887baf73656b92a59a2ce0cbac27c1fb0669e7cf9e13
SSDEEP

1536:d4QN0ZwnO4pWpZqItEUpcVSP85pd5j8l0ZMInDCepZJdoDrvVGV3Xpn32ebgV:hdggf4+78vVGV3Xpn32ebI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
1700	msedge.exe
1700	msedge.exe
232	identity_helper.exe
232	identity_helper.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 4384	1700	msedge.exe	83
PID 1700 wrote to memory of 4384	1700	msedge.exe	83
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 2676	1700	msedge.exe	84
PID 1700 wrote to memory of 3044	1700	msedge.exe	85
PID 1700 wrote to memory of 3044	1700	msedge.exe	85
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86
PID 1700 wrote to memory of 3492	1700	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\74a66561cd98e784367f8516eac2bf9a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffca1246f8,0x7fffca124708,0x7fffca124718
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11159097379797523561,9694816632959805746,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,11159097379797523561,9694816632959805746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,11159097379797523561,9694816632959805746,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11159097379797523561,9694816632959805746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11159097379797523561,9694816632959805746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11159097379797523561,9694816632959805746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11159097379797523561,9694816632959805746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11159097379797523561,9694816632959805746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11159097379797523561,9694816632959805746,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11159097379797523561,9694816632959805746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11159097379797523561,9694816632959805746,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11159097379797523561,9694816632959805746,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4172 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4dbcc666-5173-483d-bad8-507e0df54d2f.tmp

Filesize
5KB

MD5
33ef9365099cdc550d0e6a2a96ba8c4d

SHA1
7eebe6012ab27ea829a08e9fe730efbdde442f08

SHA256
064d8543b482da143bb22bbc7ba8237602d3f556a01fa56d1e8a78f8cbfcbc22

SHA512
c710b73babd8893c0310b8c031498c26d647f445fcdd1da0307cbe51aa1b66aff03c96bc011ddc3e03a9d6975d503aece7dd2ac663e4f02ebca8410427f2ffd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac49586d5b99058cb010dea4b82b8cd8

SHA1
966a6764dae9db35641a167448257623062fd7dc

SHA256
56a4145a3abd25b7d54d1dc79c52fa10163bed1717ed21c1058fdc4bbd2cd5c1

SHA512
1dfc6fd31a3de3b066694ddcc40f37c5af9cdfdece5969b16f16632149688c82823646ad28c30b7020a6640d0ccd1395aa993b8e7b4c3783f65f3e95d3832dbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
15fca5b3e37b55b497fb6fe770b94388

SHA1
9e700ddf4636867421e11f807e0fdb200e72c629

SHA256
f50dbb1a2c9d3cc0937d7da1a46d18be099bcd895774d4c14b2049ecb68e3193

SHA512
63eaa5433c69b946426440239d56c0f0ca08dd19756c295a7d680be6f2f0b9657096d73bf106b7fa03dc25ffdc6d27259881f3c10457967d1e0819d8e942fe8d

Download Submit