a4274ce153ff07d94e2615728f5d313d94401b80db3d7721e344d1f8689c045b

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a13cfcf76920e0cda4cdc01d2061fc1e_JaffaCakes118.html
Size

1KB
MD5

a13cfcf76920e0cda4cdc01d2061fc1e
SHA1

62708520342400bb4d1d56a95d0ef7a827409e0c
SHA256

a4274ce153ff07d94e2615728f5d313d94401b80db3d7721e344d1f8689c045b
SHA512

e1c69a6d54987fc37c241644913d9a0f61d69a6bafd46fdacf4d3113a7092a9d01027f3fe7b445b2018d83b46c6fe319e7151cfad2c6e87b104874ef99f8117f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2008	msedge.exe
2008	msedge.exe
408	msedge.exe
408	msedge.exe
4412	identity_helper.exe
4412	identity_helper.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 3956	408	msedge.exe	82
PID 408 wrote to memory of 3956	408	msedge.exe	82
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 3300	408	msedge.exe	86
PID 408 wrote to memory of 2008	408	msedge.exe	87
PID 408 wrote to memory of 2008	408	msedge.exe	87
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88
PID 408 wrote to memory of 3604	408	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a13cfcf76920e0cda4cdc01d2061fc1e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb649446f8,0x7ffb64944708,0x7ffb64944718
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,2354501605286504696,13908724413766960477,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,2354501605286504696,13908724413766960477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,2354501605286504696,13908724413766960477,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2354501605286504696,13908724413766960477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2354501605286504696,13908724413766960477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2354501605286504696,13908724413766960477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2354501605286504696,13908724413766960477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2354501605286504696,13908724413766960477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2354501605286504696,13908724413766960477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2354501605286504696,13908724413766960477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2354501605286504696,13908724413766960477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2354501605286504696,13908724413766960477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,2354501605286504696,13908724413766960477,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\39ba740f-7c68-4376-b1cf-3ca20f26834c.tmp

Filesize
5KB

MD5
c1abab0a7cc3d5ef6bbc1ad73db2a812

SHA1
b37ca3568722d41483fe9271f803484802db618b

SHA256
cc6c7b33b337f984b27a3f51a6b2d554c35e685d4d86274c613cf7de094c7699

SHA512
ac4de78d5715022a8739c252bcd97d38ec9d899df6af86119edac7512bcf10b7d1ecf1bf82823ec4f5a2285300d974d11d31e235ec85a646ecfd5a9b39b797e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
9c57a2d5d1fdd9dd769fa9e609900bbf

SHA1
678d8ec004736a7751e04ea7d1ae1c04e46bca0f

SHA256
1cfde2851bac6fdc69b465f94bef7de09f5e530a995057b949e4968cb9aaac00

SHA512
c14b9145f4ab946656ea9a249c1e0b114dbfbbbcaffa73d2052eaad53c5cd7ff2cf4121a1d6399c2a81712416580fbf9e58680e5554c15f45966456825e4d8f7

Download Submit