c0ee91bf72bc9974db930a8a0ae195dffc2f3834ac45aba8a2ae496abf5f0d0f

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 21:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

993e4c9778d07f1a8ec280700b25acbf_JaffaCakes118.html
Size

22KB
MD5

993e4c9778d07f1a8ec280700b25acbf
SHA1

bf37a9f345c0710bb126d6c95e8b410e7676662e
SHA256

c0ee91bf72bc9974db930a8a0ae195dffc2f3834ac45aba8a2ae496abf5f0d0f
SHA512

2012fbfc0dfdfa3788bcb59f9cebf92f825edc71a80a2f314afa4595750b0c99c107cfb73f53daf5936af4f05ad62b1f4aed50ad73e2407408fecd440ca9670c
SSDEEP

384:Uxfixf+aQ5yz9zWWDffGfdzHxEuGX0SctUFmg:kfef+aQ5yz9zWWDffGREuGk/iFV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4472	msedge.exe
4472	msedge.exe
456	identity_helper.exe
456	identity_helper.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 2900	4472	msedge.exe	83
PID 4472 wrote to memory of 2900	4472	msedge.exe	83
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 608	4472	msedge.exe	84
PID 4472 wrote to memory of 4968	4472	msedge.exe	85
PID 4472 wrote to memory of 4968	4472	msedge.exe	85
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86
PID 4472 wrote to memory of 2944	4472	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\993e4c9778d07f1a8ec280700b25acbf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b83646f8,0x7ff9b8364708,0x7ff9b8364718
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5535264039364991713,13424692127551089199,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,5535264039364991713,13424692127551089199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,5535264039364991713,13424692127551089199,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5535264039364991713,13424692127551089199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5535264039364991713,13424692127551089199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5535264039364991713,13424692127551089199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5535264039364991713,13424692127551089199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5535264039364991713,13424692127551089199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5535264039364991713,13424692127551089199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5535264039364991713,13424692127551089199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5535264039364991713,13424692127551089199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5535264039364991713,13424692127551089199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5535264039364991713,13424692127551089199,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4804 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7bb38be5a39b51acc4d1c719ed2e461e

SHA1
4883ab7f2e52b0fa2846208714bcaff72be91eb3

SHA256
8e9464cbca15d7b650590fc7135ce48a71ffcc8ae1e8b5ca50c448b7dfaf3ba0

SHA512
963d8d7dfb25b4be856b5beee9af849ef87523285a782646a53c4c7de18aa7f6851e3a55f6217e948efa2cb3a2c6a419522e6494a89300f5bb62e1021d0df5eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bfdd0fb6cfca1ad0423930d6a02d6c0c

SHA1
3e2d474b30c08498c9a58218294c23e9fe2f524d

SHA256
bfdfc49f20f3f44f11bcd48ab89a79d69967e9d2b473ab003a9ea1a5996a77aa

SHA512
b0f681c24d5ccb495a00eb321fc05b96d6f6ebf5ad6ee378412b5ef417868146ab650d9f8834fa7fbc82b14cbd942ad6c6c9355635c562b3d03cd9d34fb0e75c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ae381481-78c3-41fc-9602-cb0074163a51.tmp

Filesize
6KB

MD5
873279a212ac8c56f9a10adbde7108f0

SHA1
2b8ed82a10f5a7c8313438e8acd0b9f685d9b6a8

SHA256
f835486fc82ee8588548b6c9d9287bb25fe4d6205302b032c1ffaab22fb3108f

SHA512
7f9b2f78f64c6d9b70743c15c71724e08ca7417328e6d4fdf5aba4d467760af7c425ee534c6ebbdde73f972b60a091f81ee7c3d1cd549878c064df671f491718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d48679b8aea4c3c7547e5777c8baee55

SHA1
1c8a070fa71577bb0ad82e649e09bd0a8b64f565

SHA256
5f132f929a54dc96fe3940a6a07ecfa5eb6d5515ca0d098cac44e460bc813ce1

SHA512
9dd8a2f316af88d7d1d7bed18f02cb43953c9e46da79074b53f211afdad0dbc233501cb0cad297f55731831b223181a1b93e240d0438383aa13210ec6a4be4c2

Download Submit