604435b17c1f18caac55f81a46bed7796d92dd59be9bde53a1ff7cc0484db1a4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2024 17:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84e1f29c14eb5f7e05bd7c277808547a_JaffaCakes118.html
Size

43KB
MD5

84e1f29c14eb5f7e05bd7c277808547a
SHA1

2447c3004ba86dbc78177bd8b0192066944a391f
SHA256

604435b17c1f18caac55f81a46bed7796d92dd59be9bde53a1ff7cc0484db1a4
SHA512

0a7731c98eaab210e83773ee653148faabaa4acfd67c41a63a8ee3e0b4306a20be7cd070be4de3eba65b5b080c954f42737096905e546903a130c81549e397ec
SSDEEP

768:NS2xuX+bsWPW34hDxyOeWoLHY/VAbcWztTJxTwTjTlTXT9TIAIwwcTr4B0dgjRTj:Y2xuX+bsWPW34hDxyOeNL2AbcWzttxkM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
2896	msedge.exe
2896	msedge.exe
212	identity_helper.exe
212	identity_helper.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 5056	2896	msedge.exe	83
PID 2896 wrote to memory of 5056	2896	msedge.exe	83
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 3484	2896	msedge.exe	84
PID 2896 wrote to memory of 4528	2896	msedge.exe	85
PID 2896 wrote to memory of 4528	2896	msedge.exe	85
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86
PID 2896 wrote to memory of 936	2896	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\84e1f29c14eb5f7e05bd7c277808547a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc8f746f8,0x7fffc8f74708,0x7fffc8f74718
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,2529224991356327669,761079952898597691,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,2529224991356327669,761079952898597691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,2529224991356327669,761079952898597691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,2529224991356327669,761079952898597691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,2529224991356327669,761079952898597691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,2529224991356327669,761079952898597691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,2529224991356327669,761079952898597691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,2529224991356327669,761079952898597691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,2529224991356327669,761079952898597691,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,2529224991356327669,761079952898597691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,2529224991356327669,761079952898597691,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,2529224991356327669,761079952898597691,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
e75179806fdb60b3337e8cd5b04cd6cf

SHA1
434a695c7607996cc4d1a0698d9214afe4d9fd38

SHA256
a121c6f8b11a0682ab639049f50ef2a1b00b3a2a565d7686cc64f501056b7b19

SHA512
e1e2f888005696fb33453f369efda963c71c15270338db02d812a1ad503c1dfd2a0f693c3f6a02ca2abb7cad631524b0481141646353c7b39adf44b09bf8464f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
afe52b3d1fbaca38f2db71cbae27b96f

SHA1
e91793e0c3233d0a7081e8a31fa0fb9c3cad1236

SHA256
e1e025723a4af3eceaf9b39889e8eb6804fd44c91ebd79e8409a095e857d42cb

SHA512
520e61d1ca69d4efe0791fc10b6c6e5400f3fcaca1f9e9f395aae226abd93bb5ebbe8d5e77ffa25402a3324b594e14fb4aa6df7f080102d560c451d0719f162d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c10f775d311894b9bea52ec2baee28bd

SHA1
571643c3bbfedad78f13b09534441334f79341a0

SHA256
b48f61441cbdac3a534767462bcca8907af730c904e2be0394ea4160258d5819

SHA512
2a475fa6f16a976182c116eed48dd2126d3577e1c1b3db934be7affc35d7d764ed82e60a38e136a03d0ea080fd83cbcd8a2ae3719ce670ce82fac8c39b402cd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
a21765c9cb4d6cbbb2041396add049e7

SHA1
1df235cdf96d22c38d2f635b28236d273c38da9f

SHA256
2bb965394f949e98d0495ab93e6e11b96b5da05d733a507ce2054272377c3dac

SHA512
2133659322e4bff91f167da799ce2bd7345ba7de088f033d169dc8a0d3dcb16b113717a118ea3b2b1e68db92029d7c6c8cd2fa7cbeb056f7e42bd8f38a40431c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a73c.TMP

Filesize
372B

MD5
e27924bb8b9d5aec37f452dccc3f9459

SHA1
d3a80f60c29ed2352dad76209b63c498ed77bce1

SHA256
7d274b51c97f509158be9cdca479eaa605b574724202a49468b9269ce40b436c

SHA512
ee33c8ea54e26f793634f27a96e5741a8fe717e87b5960e6cb1948d5c0759a554056fec3e6e3510b55f3e4ae39fec90b77229d345d3ee4070ef5ced98baaee2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4d60f76e277a9b519706a8503aeccfde

SHA1
65a430d682b104faf7efda616c3d0bfc0aeb1ca5

SHA256
4188cb60f0cb5459b3f04b16390ebf03e89c4eb1178a08ed2b279a6a6ebef89e

SHA512
59e6e2960d0a062d7ea8784026345f2a835b8b9747b9c032affd1c620527945f8d5d45ceb18f1023dd6d07b7c090a5a1c9ca76b09e871a7d76a043b4d9d372db

Download Submit