c3015c8e0ed3ab4743d7def8a99e0edfbecac3046eb81fc6f4b3768790dc5923

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

764c959ebfd69ef66334c7e0761eb3da_JaffaCakes118.html
Size

165KB
MD5

764c959ebfd69ef66334c7e0761eb3da
SHA1

b08ade53d74b95a9bd04e6e2c4c580ae0441a0b1
SHA256

c3015c8e0ed3ab4743d7def8a99e0edfbecac3046eb81fc6f4b3768790dc5923
SHA512

25ab6792947ff966076f668b44282b4c7307998071cfbeb3e74e443de35422a8f35af9a50a6badeb36a7cbba93ef00bc66a477442052f2cbe9b6949059996e76
SSDEEP

1536:o16Q7THdraYGFomi8Q/ZZ/6oigPdt3Pdt3PdtE9j4EOzFzbk2xE66KFH5xKW7Xrc:ozdraTomi8Q/ZZ/6o7nnUtkIBpf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2252	msedge.exe
2252	msedge.exe
1860	identity_helper.exe
1860	identity_helper.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 3968	2252	msedge.exe	83
PID 2252 wrote to memory of 3968	2252	msedge.exe	83
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2128	2252	msedge.exe	84
PID 2252 wrote to memory of 2352	2252	msedge.exe	85
PID 2252 wrote to memory of 2352	2252	msedge.exe	85
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86
PID 2252 wrote to memory of 1268	2252	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\764c959ebfd69ef66334c7e0761eb3da_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7d46f8,0x7ffd6b7d4708,0x7ffd6b7d4718
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,13159236035550870808,3930463697538732135,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,13159236035550870808,3930463697538732135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,13159236035550870808,3930463697538732135,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,13159236035550870808,3930463697538732135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,13159236035550870808,3930463697538732135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,13159236035550870808,3930463697538732135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,13159236035550870808,3930463697538732135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,13159236035550870808,3930463697538732135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,13159236035550870808,3930463697538732135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,13159236035550870808,3930463697538732135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,13159236035550870808,3930463697538732135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,13159236035550870808,3930463697538732135,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3524 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
185B

MD5
efa3b79297b792ddfa72609e2389407a

SHA1
7c959b0d9c508607119d7c112fe81939169c8ccb

SHA256
04371cb7276a5868761433e311d805f97da580075fc9bf1a66f0a9d8ac9a4017

SHA512
1f08b7ea9823ae979382586db83b05c0d0dc5cb565b3946fb8134c0dfaaf61fdf80d6c666ceca6522964ac446d2a2e798e1f0eaff3dd2ab5cae88a793db20eaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7ce27e13b71014b859843f688203677e

SHA1
8852902a16a00dee5b1c2036b7df9ef7189cfa68

SHA256
9270d476d8d769d86b93508cf97d1e00caa09f54a84e0c6cbb7ad6bced15b279

SHA512
a9f7220ae77b4f3857bdcb98aa94ae3c669f0b5258b2da1b69707545f73aff310b0ecccd8c71c99bfb59edc0df3e14f36a352a4116564ebb88a5da5762230307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0d87d95a85cf4c4e672896ef39f0b7c6

SHA1
06e346105a00098b481960e5b9f8a58a02278e66

SHA256
689812d4bdf27f3f689f1e633e5375ce7ef11feb01088fe3eb9e7a56e9c40bbc

SHA512
cf4312dd02771c44d6f25a4b0dc75ccc6f096695cc8e1314d6a56b46d9c796ff87588287c398b29e7a591e9853289c16bf3b9061545385dea08e6fb7014c30fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa042b79d0e9b710cceb3afaff6314fe

SHA1
7fdc45db0da7c4935c53193d8ea46afcafd616b1

SHA256
2d66e78c2835c7bbd7b9b65a64d3e0aa02a3dd807e25791405e3d7b1c6cf3199

SHA512
c4704dc90922fd50948da7fa56b4a4f1e41a4a768e115cf81277a856da76b93acbe9605e8ee47faf7b3b4b0cfb20cb6d32ac41cea648a871c0dd398f933ae210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2c9d99292f61f9b6501a482999c03f9c

SHA1
5aedfdd6a5d49ee5ac834b190e1121a11058cd24

SHA256
6856363d7c3c1cbfe4973ccc0501b32b05795abd5fdf1368a727f425ab4f0ed1

SHA512
63828571c7c7f248e6fbd01687b4100ace9417cd82d070de829269c00df4196ab11fc3b348897ac72eb57d3cb261f2f151c08ccc012780e55bbb64c5d2884020

Download Submit