6170f46eb107e04d6b44a9fa16e67691ad6b95fe3733652a6d674da14f87772d

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a682cb4d05f724c2a44e2dc85b72c900_JaffaCakes118.html
Size

36KB
MD5

a682cb4d05f724c2a44e2dc85b72c900
SHA1

89631c41fe4eb1acdd6d0851f6ddb00628e1e1d5
SHA256

6170f46eb107e04d6b44a9fa16e67691ad6b95fe3733652a6d674da14f87772d
SHA512

034ca092e44f8eefc9dad18c43e4cf75f02f8a60b371bcc05353855bd681545d446f5fe2df06ee317f97baecaeb5d8844c7551d11c0b4467ac11c6f0e16fcf59
SSDEEP

768:zwx/MDTH1d88hARzZPXaE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TEZOv6f9U56lLRA:Q/DbJxNVHufSI/u88K

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4640	msedge.exe
4640	msedge.exe
5088	identity_helper.exe
5088	identity_helper.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 1608	4640	msedge.exe	81
PID 4640 wrote to memory of 1608	4640	msedge.exe	81
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4768	4640	msedge.exe	82
PID 4640 wrote to memory of 4920	4640	msedge.exe	83
PID 4640 wrote to memory of 4920	4640	msedge.exe	83
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85
PID 4640 wrote to memory of 2580	4640	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a682cb4d05f724c2a44e2dc85b72c900_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf8c646f8,0x7ffbf8c64708,0x7ffbf8c64718
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,8316756819826143265,14364908189968559688,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,8316756819826143265,14364908189968559688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,8316756819826143265,14364908189968559688,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8316756819826143265,14364908189968559688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8316756819826143265,14364908189968559688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8316756819826143265,14364908189968559688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8316756819826143265,14364908189968559688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8316756819826143265,14364908189968559688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8316756819826143265,14364908189968559688,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8316756819826143265,14364908189968559688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8316756819826143265,14364908189968559688,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,8316756819826143265,14364908189968559688,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
24bb72da47b488519a53e5a93c7c363e

SHA1
051f3b993ee8e190855598c588163196982cbb39

SHA256
3b6e530ef7abccd743c0d867f0120a2c2e85b4fa1b14b8967c7dc52e583a17eb

SHA512
ddac427a9d8ec14513787e4c968a3b8fd98a0ea2872228bef69c1c1ea7735516e95b551f1343ff1526d6d275ec83c7cf570bab9a04b3e9d4c409d50ccb617840

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb69ed018dce27a3bee3ef4d249fc618

SHA1
73e632df08e4cb2049dba83a42b92cff10ce9a8b

SHA256
b8b8ed2480c76929ae3d8ad31484a33b47820b35d4f9d1bb6d3b33e1140cf170

SHA512
afb42ec3c16ad46d7036cb7d68e562b5404a9ea82aa1c22109a5df259141b5f7624caeaa1b180ec68442a7cb413ecfa197e1914fa0761ff6edc4fd7489ce2f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
20a3b9db1b27ead0acde94d76c8e5780

SHA1
23b711298db5e44601fa8fe20bd9ff7492f6d3ad

SHA256
2402da59ad9a5ca84bfd0ffa86bdbb0152a096ffca0b6d6813542cc4e8d2f1fb

SHA512
a699cab4513500b33b33713a1a9d2a69a5501ac672b5adae7d3aff1783c0d5b56fe505f944563aecbe86b97a170d1fff7254eee87bc0a0a3f36d2f0a869d3bd3

Download Submit