57eb45d263c30555a44e0cb1c61d75751f27da794253723210096e9ed5a76422

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9699487cc03022dc276e3e084f55898e_JaffaCakes118.html
Size

27KB
MD5

9699487cc03022dc276e3e084f55898e
SHA1

c4697824d8b5a5481b89c24b983c33f1125362d4
SHA256

57eb45d263c30555a44e0cb1c61d75751f27da794253723210096e9ed5a76422
SHA512

30e5713a1929046e494b261014459a34a828ffba9f37e63493fffc10fd9f7dc59f6d5f06520a8f87698da29f07b65cc27bbb15daf2f361c3413feed2d7aa4f66
SSDEEP

192:uwb8b5nUmnQjxn5Q/fnQiemNn2CrnQOkEntdJnQTbn5nQ9eUWm6ApCEQl7MBGqnc:BQ/IC/N+qCvSYx

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1108	msedge.exe
1108	msedge.exe
3452	msedge.exe
3452	msedge.exe
2736	identity_helper.exe
2736	identity_helper.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 4784	3452	msedge.exe	82
PID 3452 wrote to memory of 4784	3452	msedge.exe	82
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 4536	3452	msedge.exe	83
PID 3452 wrote to memory of 1108	3452	msedge.exe	84
PID 3452 wrote to memory of 1108	3452	msedge.exe	84
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85
PID 3452 wrote to memory of 3816	3452	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9699487cc03022dc276e3e084f55898e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff089646f8,0x7fff08964708,0x7fff08964718
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12172693800323107517,1704173852858845023,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,12172693800323107517,1704173852858845023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,12172693800323107517,1704173852858845023,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12172693800323107517,1704173852858845023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12172693800323107517,1704173852858845023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12172693800323107517,1704173852858845023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12172693800323107517,1704173852858845023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12172693800323107517,1704173852858845023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12172693800323107517,1704173852858845023,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12172693800323107517,1704173852858845023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12172693800323107517,1704173852858845023,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12172693800323107517,1704173852858845023,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ae92c6d6a95d3755819c006d4d8a6ed4

SHA1
865ea920a1d7c752a4b3b8f310ca8eb861951cc0

SHA256
b27bfcff344f91f7e74ffeff7422e16b98c8474b86a7b3fba3336a09164db78b

SHA512
f79e4919218aac4a26e83162d0ce8cc7e1c7f47ec9a1a06fd53292aa7532a33873b7080e7220b8eb4aaade31d2d145c9d6a36310a8e8ee348aad6576a72bba1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c3bd307285a4c491a87bed2362c1d8b

SHA1
e90a1fdc9239cf726bbb685915b8482199775fab

SHA256
01f8e83725251fe78b3bef8f31e2dfb37410fb8990826665cad74efbae6fa342

SHA512
2de60a246f728f11e81e189aced576282936d3838d6bdad29a8285183d2d3af07bed09dd3ed0875ab5a9238312ee198a1e50edab2e8d71b9faa64e8919eb9cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7e41c139c446dbad60a3fb96d4330481

SHA1
1451ec15ff1480cf707e99ecd7ceebb030c9fac5

SHA256
c4bddf2ee84b98c74c2fba406cec86a57a5891dfe5ce67527654f2ce3cd53442

SHA512
6c7d571c208d97375a48c9c0c2e7b3555e1078cc284ac71b7dbc8b66b2b66e7e3a5056056a37a81f488740899b3cd62ea73dd3de7e8f66176b4fe362c6ca1728

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b6b0e39d22dd7607377a989a815d1948

SHA1
fd4b676252f4892e41a4b2840a2089b30752e668

SHA256
1a90ecf365043d20d554d09476ad653c9a7a01c15795f3b8b02673e5358552a8

SHA512
c09dd83e99eab01c35673fda503f963fa6fa9919929a91f14e74f63b43dc333b922c63f98ae88384abdc0f059b7e932c75c810e4cb7a0ca7ae1a02362d697b73

Download Submit