fa261b25ada9f76817f77df98022a089343eb0e31e5bb73ddb48ade43a9bf30e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abb7c3ce8797d6ac50044e6308b35a09_JaffaCakes118.html
Size

45KB
MD5

abb7c3ce8797d6ac50044e6308b35a09
SHA1

9494d7f0010bda4a7184e810adc39ef660759360
SHA256

fa261b25ada9f76817f77df98022a089343eb0e31e5bb73ddb48ade43a9bf30e
SHA512

5f21374e789a14d7978ae62479c6bec94e085ddbd3e44695bd7050a75f59c6c7810ad366ab1175213695b22d21bfdb8e5736e0caf48334f2aa5770541779aec8
SSDEEP

768:KFGggGsphif02DaiNaFLHuDhcS+Y2m7OLY5aQVV:KFGggGspO0SaCeS+Y2m7OLY5aQVV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
4124	msedge.exe
4124	msedge.exe
2460	identity_helper.exe
2460	identity_helper.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 3888	4124	msedge.exe	82
PID 4124 wrote to memory of 3888	4124	msedge.exe	82
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 216	4124	msedge.exe	83
PID 4124 wrote to memory of 2648	4124	msedge.exe	84
PID 4124 wrote to memory of 2648	4124	msedge.exe	84
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85
PID 4124 wrote to memory of 768	4124	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\abb7c3ce8797d6ac50044e6308b35a09_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9c4646f8,0x7ffd9c464708,0x7ffd9c464718
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,11770253600512031431,15781490324877896347,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,11770253600512031431,15781490324877896347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,11770253600512031431,15781490324877896347,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11770253600512031431,15781490324877896347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11770253600512031431,15781490324877896347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11770253600512031431,15781490324877896347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11770253600512031431,15781490324877896347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,11770253600512031431,15781490324877896347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,11770253600512031431,15781490324877896347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11770253600512031431,15781490324877896347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11770253600512031431,15781490324877896347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,11770253600512031431,15781490324877896347,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3c4a8d7a843150a05c12cddbe6213c16

SHA1
5274bfbb999952827886cd9bb11ecbd279bf2503

SHA256
59d692a4fe168f32a632d66c136f66572748901d2afb0ad5e8a83b334f0433a9

SHA512
57eabbc9af06af09f7fb53237ed3e2a5957fe4a9d6825482d635758dbeabdf972e558ba04cb8e692d3e8b86f4872c3adb91ceae28531afef4ef91f6723ec4e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e06f0dd42a65bbc14344a76ffb31a79

SHA1
a70c569d27fc651c73350d5fb1abafe2a27d23ae

SHA256
c2bdbe33d83edc9be28701f876aec2fbfc02b7dad1b9445a70f46bd4277ca4c5

SHA512
1097bd126b57c39705dd705032947c70832cbba11230b2b0b8e3f03ae6ffd3b1cfef261b4a30518766c441b262f12739c2b8d7e6e8de2fbc7dc9cf1d80cce89c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ee64767bba6db9fd3e0068c6a6571c7

SHA1
2474f0012f328ae63215cedef294490efd74681e

SHA256
1e20062679e0a89f46aa9376e7a0fc672f38bc68c26d3bb33f4f7c359dfd03d2

SHA512
2768948c94c0418feaae1dc57670913de98a47e6025d6992b76d8730b272e788e916b5b1657742276bf3b0db365522eb759d08713cb12b651954367e05849918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bf42ade31e3eef02997e2037eaecdff2

SHA1
b10404bae908bb0638254bfc34783014a3deb9a9

SHA256
4bcff0c3e04699766c80350f94d914aa3519f36ac4b04f08f54a460d5dff0ef0

SHA512
174bfa00e6ec5e9d3b96b2d8ff15ceb740338051b7ce4237605241c7a16b3130de91ff20f494bf7f8a02a99fbf3c7895ddb996616fed7280109f9aac487fdd59

Download Submit