7e66beb7d35a5ad6ee66aa7a7d12c308a4edbbff64a4b4699a95f885fd9e56ad

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a657c9c577392663cb071568a9dbd11a_JaffaCakes118.html
Size

42KB
MD5

a657c9c577392663cb071568a9dbd11a
SHA1

48bbc04217876c2ff8a1e6aa2d1355d99b4dc409
SHA256

7e66beb7d35a5ad6ee66aa7a7d12c308a4edbbff64a4b4699a95f885fd9e56ad
SHA512

af90cd7b1700b7ef44df89c5a3dbae37ad38c4cce6e3bb9bbecf8a4f52f6cc616f94ae9716ff4e799eaf4cc5fd7a8e7b62b059f59e15466d7fce1f925b91c525
SSDEEP

768:SbCfCGCFCvCOsCkCQCaUwvtSglpE7TcPKeDGSv9VtV41Gwbe:SbOTMum1N30glpE7TcPKeDGSv9VtV4q

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
2528	msedge.exe
2528	msedge.exe
3376	identity_helper.exe
3376	identity_helper.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 4868	2528	msedge.exe	81
PID 2528 wrote to memory of 4868	2528	msedge.exe	81
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4052	2528	msedge.exe	82
PID 2528 wrote to memory of 4996	2528	msedge.exe	83
PID 2528 wrote to memory of 4996	2528	msedge.exe	83
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84
PID 2528 wrote to memory of 2468	2528	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a657c9c577392663cb071568a9dbd11a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd08de46f8,0x7ffd08de4708,0x7ffd08de4718
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16343976283667236935,2238383801945554662,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16343976283667236935,2238383801945554662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16343976283667236935,2238383801945554662,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16343976283667236935,2238383801945554662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16343976283667236935,2238383801945554662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16343976283667236935,2238383801945554662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16343976283667236935,2238383801945554662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16343976283667236935,2238383801945554662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16343976283667236935,2238383801945554662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16343976283667236935,2238383801945554662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16343976283667236935,2238383801945554662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16343976283667236935,2238383801945554662,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5332 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
289a0487d76cde24053cddcf066f35ba

SHA1
c11197a1b43ff04d8c4ff50edea7a4ef17ed9073

SHA256
9be62d84df937ad5da60230072365c12d19b1259fa1962e25c8b2eb2460ef799

SHA512
f21bdaf44e365acfa300ad5dad445f5a1591900d2820798da9d2d407da2cdcf063f4b8003540cc5f66cc4c5050dc5875272acf68e7ca3470b5aef5825f818db8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f5866d4225ff7d0ffb39cd2bd94a9e6

SHA1
9e30179af91da76a29664722a1018f752fc3a7ff

SHA256
b50a02d4994e9f8cea08dfff68a04f6e4eeb138b373f09ea570ac3fd0207c88c

SHA512
5f62af682550ea70239c2429d5a36ded1dd069595e2494a279b32e815639fb8812acefe21e38b6ebe0989fa715acbd08090dfe7580370abb45e35c02a371a044

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1166465a26be7cf5889d543bb6b18417

SHA1
527b7d03e1373cd7a82c73becf3b7de56b18f706

SHA256
785a3d7570ad450d5f83f43ec6274b19c3294d8d529fbfa4abcdbdb388eb3f7b

SHA512
d312937b1fdaad621603ad06b9fd7b1c54f32eb320f65a4404a9bf926ed28224097d629defcdaf1be2ed1ab39cd3be5a183e85a84b3561eebc20defa5a726833

Download Submit