8060c2d7a9c7d02fc12c2037354196b8b53ae2ee49e93e76175eea93efe57002

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a33694ed5d43c2360ac7579a63515008_JaffaCakes118.html
Size

22KB
MD5

a33694ed5d43c2360ac7579a63515008
SHA1

b2d991009d888cf4b964a70b115b5fc4443ed062
SHA256

8060c2d7a9c7d02fc12c2037354196b8b53ae2ee49e93e76175eea93efe57002
SHA512

65e8924b2387cabbade9f24e31d4ffa315d5dfe0aeed3b5c39c8152e15e97235be27eef197b531973ca3488dfe44c0708d9a935979f00860ba405c1e96ef0a83
SSDEEP

384:zi4KSRq3KpQEkRkr9DC1aVBD8c03RQNiEEX0mEfP4ycbp5+zVcrmDJZTOyuPS:zifOQir9DC1agc03Ii30mGP4ytZJZTOi

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
4572	msedge.exe
4572	msedge.exe
4360	identity_helper.exe
4360	identity_helper.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 3796	4572	msedge.exe	81
PID 4572 wrote to memory of 3796	4572	msedge.exe	81
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 4084	4572	msedge.exe	82
PID 4572 wrote to memory of 3816	4572	msedge.exe	83
PID 4572 wrote to memory of 3816	4572	msedge.exe	83
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84
PID 4572 wrote to memory of 400	4572	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a33694ed5d43c2360ac7579a63515008_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80afd46f8,0x7ff80afd4708,0x7ff80afd4718
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,1004364759117363507,16804530047674786021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,1004364759117363507,16804530047674786021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,1004364759117363507,16804530047674786021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1948 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1004364759117363507,16804530047674786021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1004364759117363507,16804530047674786021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,1004364759117363507,16804530047674786021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,1004364759117363507,16804530047674786021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1004364759117363507,16804530047674786021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1004364759117363507,16804530047674786021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1004364759117363507,16804530047674786021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1004364759117363507,16804530047674786021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,1004364759117363507,16804530047674786021,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2512 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f247e724c96b73eb13279642b2520c39

SHA1
5b95ff6576695a7ac85fe3a7c53a45bf8982c417

SHA256
95f8ed050aad54bf166b03c7cce1b95aa8f2a0ae97fd9a574da3343b8cfbeff1

SHA512
2efc5836680b4c26574f6bbd707d8bd32ef9d3723ad160428a50a14ac14626e662c5d4eb84fcad6e73452f3793899a5dee5620eb1b8aa86e436d64f2f1dfb14a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e91c93cf9c3f4e11268e1ed4fc60674

SHA1
7545c0135fa582ed41020a8ac6dd05c24125590d

SHA256
80e0bfc3c6282c7a4aebb02ff5d3be408a9fe39d61356ca21ccf1514984a21e0

SHA512
5879905c0570c766e67e5a56293fd98b1b1d9bacd2114b953880c6c2529c1d1ec9e16590905622040eca5e91f3cd219da83ef2feace6d40cc9d3bd8ff24878de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ec6bded4e2d21afdfe7b19ebef790d47

SHA1
eaf14a51611c9e66d3126225217b628e7822cc4e

SHA256
5f68a5ee95959b3244a6e318d666eaab7cce333fd453d5c5b2e42d209d7369f1

SHA512
41f051c002342e572d4dde17a631839988463782ef23b04bb943a5a7af71cdb006a611a5f351b2c2dd8576273563780909137fc45927d6baf87f183432996842

Download Submit