bc07917871abb8e7c14dae04b7131b2e888492617be1596a904f67c52a7b0045

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5095e32cede89803b50141af91c6dda_JaffaCakes118.html
Size

40KB
MD5

a5095e32cede89803b50141af91c6dda
SHA1

409f50743ee3fb49fdc6db738bcbc324404d6c97
SHA256

bc07917871abb8e7c14dae04b7131b2e888492617be1596a904f67c52a7b0045
SHA512

10bb3b3e51f8305fc34e9f9c759d757a510ecb7afdb049a294f78d6831233ea63060a6217b8e1888e1b07028bd074bf4594ad6ae361a4bf9e79647fd775371b6
SSDEEP

768:N2a/KJjvYGGgaDVJatZhAvUtZpCizTPiA8:N2a/KNvYGGgaVJihAvyZpCizeV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
4012	msedge.exe
4012	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
2264	identity_helper.exe
2264	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 1360	4012	msedge.exe	81
PID 4012 wrote to memory of 1360	4012	msedge.exe	81
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 2256	4012	msedge.exe	82
PID 4012 wrote to memory of 3196	4012	msedge.exe	83
PID 4012 wrote to memory of 3196	4012	msedge.exe	83
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84
PID 4012 wrote to memory of 2056	4012	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a5095e32cede89803b50141af91c6dda_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6fcb46f8,0x7fff6fcb4708,0x7fff6fcb4718
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9919479348167482238,13995605931595367792,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9919479348167482238,13995605931595367792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,9919479348167482238,13995605931595367792,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9919479348167482238,13995605931595367792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9919479348167482238,13995605931595367792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9919479348167482238,13995605931595367792,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9919479348167482238,13995605931595367792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3948 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9919479348167482238,13995605931595367792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9919479348167482238,13995605931595367792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9919479348167482238,13995605931595367792,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9919479348167482238,13995605931595367792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9919479348167482238,13995605931595367792,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
296914c07183eaeba1e173db33d71652

SHA1
bcfe9b856c350fc43fef45ed4a1a942ce271aea1

SHA256
fb5d2153bee6f7f0e2131b268f792eab8cb9aed429d5f93559359e8406117711

SHA512
1b2a984adb700a5cb727134768450e093029ab226d05a14ac065f2d575bed06b51c8d1502c34647e979c6d448992112ba5fae79880dd548e33f4864ca36560bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
08a0cc15304b72a4947a6496afee3d83

SHA1
33bf6882bbf58d4d41980c79a4f97bdae0d4dc05

SHA256
1579b0164f107650b9d5f2828681431fb533a458a88327531a5bde15f54f3ffc

SHA512
e49c37e1306b4ad1aa6a0d8bbe50c545557bda9d626c9a0aa170dff5d7d08446f5bac52c839503cff249ad56a9cbbc2d19b24072dfc8d26d7f13e14f8169ec42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
045232fca835608ec6f0b37fb19ff787

SHA1
1dbe2d3d57dd93e053248d096d192fbc4895454c

SHA256
fe4c9018ef7ee532189f6bfa1c9b870b110bf6cf20dc92b4e007c4995a362ca9

SHA512
7ed8650f422087f3172a4d589557aebdc7ad3dc164e5370684a7c17665a59713b846a251684256f9859fd8df7cb609e23fdbd6abecaacf7ccfe2966238d7d6cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d2ea04a8c879bff26e86460504e2d3ec

SHA1
4dbacb90f7a49cb7ab71c45b822f876d0594ca61

SHA256
e1b27655ecda58ca5400e340e1bbd9eca308dd590e6c4a0e233ef826aecd6219

SHA512
07adb5a0839d96e401eabfcf8dc45a07a44f4b77b8ceab53682c21afb38fda8f77084853df98c11a78353e1905f866252a407fadae73c859e56dcdcc6cced0ce

Download Submit