51d868aa87e20bd64b2b1fc22f9a5fb1450d315d6764383a8829e0f8f9bf0b58

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 06:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4519adaf79f307644e262bcf9e4d42b_JaffaCakes118.html
Size

36KB
MD5

a4519adaf79f307644e262bcf9e4d42b
SHA1

e81f803fa822beac8ef8942d701cc58b3e7da5ee
SHA256

51d868aa87e20bd64b2b1fc22f9a5fb1450d315d6764383a8829e0f8f9bf0b58
SHA512

b45111ae482e540a736d6c1d063216b3b0e5d7b8c6c4c5e96baf6357722aad4513c5c859fae6363723032a9e395dcb5e6aacf6f7e0e286622e98cec2f4cc989a
SSDEEP

768:zwx/MDTHtF88hARYZPXPE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6Tsdi6f9U56lLRc9:Q/TbJxNVpufS6/s82K

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
4432	msedge.exe
4432	msedge.exe
3928	identity_helper.exe
3928	identity_helper.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4628	4432	msedge.exe	81
PID 4432 wrote to memory of 4628	4432	msedge.exe	81
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 4860	4432	msedge.exe	82
PID 4432 wrote to memory of 624	4432	msedge.exe	83
PID 4432 wrote to memory of 624	4432	msedge.exe	83
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84
PID 4432 wrote to memory of 4196	4432	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4519adaf79f307644e262bcf9e4d42b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a24f46f8,0x7ff9a24f4708,0x7ff9a24f4718
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,3465889850598007345,12206236145880446279,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,3465889850598007345,12206236145880446279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,3465889850598007345,12206236145880446279,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3465889850598007345,12206236145880446279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3465889850598007345,12206236145880446279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3465889850598007345,12206236145880446279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3465889850598007345,12206236145880446279,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,3465889850598007345,12206236145880446279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,3465889850598007345,12206236145880446279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3465889850598007345,12206236145880446279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3465889850598007345,12206236145880446279,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,3465889850598007345,12206236145880446279,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
1d1bfb4b5a3945d3d5c7548c0f27b636

SHA1
5168b909b0d14688fbc23165dd8fcac23949e5d3

SHA256
dd6074dbfa9ec49ca77e203d2cb4151489f3b553f4a17b002f2222752ec955f3

SHA512
556e28cfdfce857f9d22a415257b9680abeb69cb1425df2bd571031457515c9c3ba1f44c068355c6ef52a447f35a6a0356161b83adfa5f9e14632fc035aaef39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
717db783036645bba48b94a9afdeddc2

SHA1
3b7d70cac2abef672d913ff42c3d68867eb2befa

SHA256
24d45215a32a3a233f57ed81618d2c4d1a02826da076738f051af3bbc4db8f68

SHA512
e81ee61350186b4cbf373709d8f731f83faa2c14cdc3d07f23301f0044fb93d68a439fbff9910b2056886c5ea1ab54590f95a2a315c7b0626f90c7491809d001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5d34b51abf82ae215b74b90022dd8f2

SHA1
0268da67fe7fa987cc311733329dd61fe0eb8b00

SHA256
e4107fa8e4b2a87f7ddcbf1ffdf9b4da916fdd29e86d9522b6b79e1c60e7b546

SHA512
3a5fdb8797a2c75a68b35a70b020e7d417a868f0444a0fa4eb5aba828d7bd1dd801a09b1b61179a1305dc87c905e9ffcd5c3f3e709bd29ed5d2e0eaf9199a83b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5352bd4c14b6b6fc5acd8e710e5d5f25

SHA1
3f3b8d5704ad3f7cd152953cc76598cb8c48d12d

SHA256
5df5ede8d087cbd4faf30d6b83974177175654df8219039a650d33f955f8cfe3

SHA512
f43f556dc1cd2a906021e219d6c6d78c90edfaa3c3a1e83c3d20972be25998b10632a5e4366e1a9e8e3a694e0c8cc7d25292ee448f1948bb6e1684d6c917ae59

Download Submit