c2ca194651efe0908421f7fce83d59596d047c3b7ea31175b8bd5d696f7e4be0

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7b818c7e252884cf07b3529b100fe1d_JaffaCakes118.html
Size

16KB
MD5

a7b818c7e252884cf07b3529b100fe1d
SHA1

ae11c6b5b0befd94df31ada6f07377dc7fa5a404
SHA256

c2ca194651efe0908421f7fce83d59596d047c3b7ea31175b8bd5d696f7e4be0
SHA512

4815fb7592c9466217f191413ce8f9499dafd6f9c5f8337b1dd560ccbc2fadc005f3dcd40e2dce92018fcb4409cb86e695c1569f13693c08be05c9ac569bcaee
SSDEEP

192:LpCfQJUw0ZqWFHKfAFHDJp8qo+Ji3zAII+wKfAVLy61rg+Vu7dV9pgjzKfoeMapL:NYLT7FII5zIDIjzgHuY

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5188	msedge.exe
5188	msedge.exe
3152	msedge.exe
3152	msedge.exe
4216	identity_helper.exe
4216	identity_helper.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 3908	3152	msedge.exe	81
PID 3152 wrote to memory of 3908	3152	msedge.exe	81
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 3900	3152	msedge.exe	82
PID 3152 wrote to memory of 5188	3152	msedge.exe	83
PID 3152 wrote to memory of 5188	3152	msedge.exe	83
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84
PID 3152 wrote to memory of 3372	3152	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a7b818c7e252884cf07b3529b100fe1d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d4718
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5006532273400972582,17339917422422469685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,5006532273400972582,17339917422422469685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,5006532273400972582,17339917422422469685,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5006532273400972582,17339917422422469685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5006532273400972582,17339917422422469685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5006532273400972582,17339917422422469685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5006532273400972582,17339917422422469685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5006532273400972582,17339917422422469685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5006532273400972582,17339917422422469685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5006532273400972582,17339917422422469685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5006532273400972582,17339917422422469685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5006532273400972582,17339917422422469685,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4668 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7c2be1ed714897953248b95a97f23a00

SHA1
6aec4931f42246a81355a273ccba5b6401ad79c0

SHA256
a5e99089c70f19dc670de50afd2ed452fdbe681beb8c5f6ae0fc626f18b07b35

SHA512
b7bca442fced9e873ed32c405537f1a03f7d0553b71bfad8f8d7e8097b87391f411a22b2fc77e30aaabaf9a8e79aa03b59517acf5b3e62b7184a676d0b05571c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6bdb6d1e5709efca2751434df4129d5

SHA1
6ae941932d8c5d80f1978bfb9ec5813de849aeea

SHA256
31c451faaa429f8faae2a8401a6b7d48fbd499a3fa72275af6cec39bcf5bc841

SHA512
c56d424c992f9bb4a3e3825674fedcf5032ff91a7006d424fa4e31ea8ac05b86772bbf2fb69ed2c271488831f8f9c5a7861a42621d352e2e6ae1ed17480a97f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
dbf1bbbefdf7f12a50d75bad3aa9c3aa

SHA1
f4fe50300ed48eb2d7051904781fb8c8513ff8e0

SHA256
cb2601b24296cf32fbc33523544815bf22178c085d28602784f81be90a58cc8a

SHA512
dc4b5e6c469fa7c2c869442fe43f1c25693cf0ec371986dfe0dd8da5fded3f90460725c278a2c4d860fddc78aa57c6864c19a0207adfa9b068e2fff757e6917b

Download Submit