1c99e5ad901f5d129f1316f6ec053efe7d86e91d132e76bc9edca7e6d1aaf964

Analysis

max time kernel
142s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b974e1ce4e39aec3b2b081e5c1cd4fa_JaffaCakes118.html
Size

34KB
MD5

8b974e1ce4e39aec3b2b081e5c1cd4fa
SHA1

542f5d8f12db41b5406b9265ba26b78c31c5f578
SHA256

1c99e5ad901f5d129f1316f6ec053efe7d86e91d132e76bc9edca7e6d1aaf964
SHA512

3a5bfae3cd5b07e1e6024a85f581f90ffa6a390bce35b41d03677e2d9849eff2be7579bfedc1dae1ad01867f30cb5337044df391a40aafe85d80bb870a49fdc5
SSDEEP

192:uwzjb5nlXWnQjxn5Q/YnQierNnjnQOkEnt8unQTbnJnQOg7cwqYtcwqY56cwqYd3:bQ/MLnsXLLdrLRQZdxtdcaFFj//Fp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
380	msedge.exe
380	msedge.exe
4944	identity_helper.exe
4944	identity_helper.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 2436	380	msedge.exe	82
PID 380 wrote to memory of 2436	380	msedge.exe	82
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 3404	380	msedge.exe	83
PID 380 wrote to memory of 5104	380	msedge.exe	84
PID 380 wrote to memory of 5104	380	msedge.exe	84
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85
PID 380 wrote to memory of 1360	380	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8b974e1ce4e39aec3b2b081e5c1cd4fa_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd92c546f8,0x7ffd92c54708,0x7ffd92c54718
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,1904380357924189808,12218110844441030016,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,1904380357924189808,12218110844441030016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,1904380357924189808,12218110844441030016,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1904380357924189808,12218110844441030016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1904380357924189808,12218110844441030016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,1904380357924189808,12218110844441030016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1748 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,1904380357924189808,12218110844441030016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1904380357924189808,12218110844441030016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1904380357924189808,12218110844441030016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1904380357924189808,12218110844441030016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1904380357924189808,12218110844441030016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,1904380357924189808,12218110844441030016,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2675fb36-fbc4-42c3-b10f-607ed6734bd8.tmp

Filesize
5KB

MD5
47016a0bfa96a6e1351b25a92f9c28f5

SHA1
8fd4ac01c2f4ba1de07b3e3d02e55e897644f34a

SHA256
c77b5b27b41447e10062b16db892c75bfe51c3c63cf59b33e6517e2bd16229c2

SHA512
fcbec39eff3131b3e4098dcabe537892c8f1bc8e9fd9072e79e5659ae0cb1b4fb3aaad3417812c10254dd97d4504e27a16f712adb338ae730fdb05c86c809546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ac99cf8447072340d8e5f60caa624e9

SHA1
481f12d96ff89cb7ea91ce8a699c81f8bb8ccd07

SHA256
db7ea5b7a1683df493c5706d1279b6fecf752c33f558c0c195f489f5ea372113

SHA512
b23e3cd74546b642225e81326a31fc503afd437a1829bc17c20aad649a9d69498a58ccce62a8b28b133625e0b7c2d1b79b78b96c2c4d80c22f9bec45c18d6815

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98be061431c468dbcb3778af5a0c15f9

SHA1
46417b28f035e51fc4c541b44a51388e2b3a39c9

SHA256
7f94b5816b203a210bff61408266afd5dfcab5c1c0d3d1d5da58a12a0656904f

SHA512
f2a4489c6d2fe411a9c59a4e477cf217ebceb0f1bf308a75e41fa37429e966bd08268bc5b1caa7d3797bf05656e86fda82af2bcd4eac30f30c44a5bf7310de1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ecd78480d4fe14fbf862d8f1a1495b40

SHA1
6887228e3a68d8cb3bb37d83a21e1b005d4e0141

SHA256
5d68586f470253ed26ff26824458aefe01e8e271438f8eaf4bb515bee4438ae6

SHA512
09113edd1806e0f1d3db94611881fb3c1227dace6e96ee007874ee3e02eb580807ac2a9aeed15987d5c813984ffbe595d756ac02d0b43c218adf52a5a5a08bf6

Download Submit