492dd48a934e4652299d3cd06a61ef2d15f99396184f93593dd2babeda7b41b7

Analysis

max time kernel
140s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

752e713c980c70228418114a41c9be06_JaffaCakes118.html
Size

34KB
MD5

752e713c980c70228418114a41c9be06
SHA1

c6f5538ea1c76fb91d8e6cb65799277271757fd3
SHA256

492dd48a934e4652299d3cd06a61ef2d15f99396184f93593dd2babeda7b41b7
SHA512

4375c1900ae3c43094685388930098561b74ab015aba1deb9eed454750bcb25294ba3df79bfea4a21a12ae27b91905e63d6d4b1182636800858fe81cb4c5078f
SSDEEP

192:uw9F5AcjrlIIob5nGsxtB549tgClYcwnQjxn5Q/AEnQiek7Nnb8fnQOkEntSm/LI:1Q/VUgtEy0domQQ6kWcdPLKF8q0OB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
2244	msedge.exe
2244	msedge.exe
3980	identity_helper.exe
3980	identity_helper.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 3032	2244	msedge.exe	82
PID 2244 wrote to memory of 3032	2244	msedge.exe	82
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1672	2244	msedge.exe	83
PID 2244 wrote to memory of 1176	2244	msedge.exe	84
PID 2244 wrote to memory of 1176	2244	msedge.exe	84
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85
PID 2244 wrote to memory of 1448	2244	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\752e713c980c70228418114a41c9be06_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84b6d46f8,0x7ff84b6d4708,0x7ff84b6d4718
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1194796342610845272,11063388257843198457,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,1194796342610845272,11063388257843198457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,1194796342610845272,11063388257843198457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1194796342610845272,11063388257843198457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1194796342610845272,11063388257843198457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1194796342610845272,11063388257843198457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1696 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1194796342610845272,11063388257843198457,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2000 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1194796342610845272,11063388257843198457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1194796342610845272,11063388257843198457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1194796342610845272,11063388257843198457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1194796342610845272,11063388257843198457,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1194796342610845272,11063388257843198457,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5308 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b9e7cd71f73e37c93e8ba3b297d29e59

SHA1
7c8cc7967759af4e4873344f80572a6e63a21a8d

SHA256
7e88b707322ecd51712a3ee349ae74574f2e3cbf5192fa662eab42d56960dbaf

SHA512
411fa16e8d5357dbd4f14201174d3c9b7387e0b6ee957d000eb4d1a39b22f6a64c31feae6d1fc0edd483a9075e7141097c92475a8286a9db60743765b1d82400

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
983676494aef5544d383ea14ebf241dd

SHA1
581185124199c3aee477e0bcf56117634aeb75ec

SHA256
a0a56e4c55bb0e3f3551c0e689806bd5cfd6af0ef8b952cff7ecadd004003890

SHA512
f6811722b37dfe361901fddda383f2fe48e5285055388e0e809ecfb060facffb5e8eb2640a6b2275a45689d3e65fb00509c4a179762cec78dd3869cc4eb42647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d31c3994b43a71e33ae2f502e6d9cce

SHA1
5fa66ad917607d524e2b663c7cb46dee16f1c9c8

SHA256
ad9aaa1721dee2ae3072c9de9179e26c3b607a6a3dc1bc18835936e5fd29562f

SHA512
260d8c221f5ce20dce8fa3b1cbfebe6a0a27886ed1dab8bdb83743f7750fe35218abd9d06452380fed6b9ffa237f228cdabfb761120d637414614413f9dda8f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
edac373d182d8b62d21c32d8b33a0405

SHA1
6ab5187db73588ba993d88a1acf52c0679fcabdb

SHA256
492898d26916bd1121ddba9dffa68eba342c064a0d30a5a3c25b5aa4f234dc15

SHA512
f363e996fc1cd80b1d68e9a4499b32bd17deb1ca166bac63cedbd5ae45a8fec1d6816195a0a1f4f08ac01cef56ffdf0302f866922740287eb759927e22de93dc

Download Submit