555b9c94b8a42f2d1b1a27679e9c0651e139c46b4206e374fae121f409da1b8b

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aac2b49924bead5184d4be4e762ad780_JaffaCakes118.html
Size

27KB
MD5

aac2b49924bead5184d4be4e762ad780
SHA1

2b7370da134ba9d2fa983d71cc5f376fac2f18a3
SHA256

555b9c94b8a42f2d1b1a27679e9c0651e139c46b4206e374fae121f409da1b8b
SHA512

367aeae0cb6c0aa4e47be86cdce403ba5926d070b726e476d4c8aea40e887b813a62d04019920a2ba836da9f3c39eab738d5ffb7982b9fda80afc035b52190c3
SSDEEP

192:uwBlpUITTUkEb5nKgR1BRkpRkSdk48nQjxn5Q/gAnQieM/Nn21S17nQOkEnt+qnz:3Q/0AlL8+AVSm5De

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
4640	msedge.exe
4640	msedge.exe
3440	identity_helper.exe
3440	identity_helper.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 1852	4640	msedge.exe	84
PID 4640 wrote to memory of 1852	4640	msedge.exe	84
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 116	4640	msedge.exe	85
PID 4640 wrote to memory of 4044	4640	msedge.exe	86
PID 4640 wrote to memory of 4044	4640	msedge.exe	86
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87
PID 4640 wrote to memory of 1464	4640	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aac2b49924bead5184d4be4e762ad780_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9db446f8,0x7ffa9db44708,0x7ffa9db44718
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,4106725641337879793,7685112661904983511,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,4106725641337879793,7685112661904983511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,4106725641337879793,7685112661904983511,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4106725641337879793,7685112661904983511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4106725641337879793,7685112661904983511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,4106725641337879793,7685112661904983511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3012 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,4106725641337879793,7685112661904983511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4106725641337879793,7685112661904983511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4106725641337879793,7685112661904983511,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4106725641337879793,7685112661904983511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4106725641337879793,7685112661904983511,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,4106725641337879793,7685112661904983511,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
319b4105b4418af7c23e0aad5bda17a8

SHA1
1ee6a75c947cf5643e935eaa0bbd18fd22ae8a75

SHA256
177c83dc48c3f14c1308ade1d912bf1816db934d27b4dec18d0aae304804066e

SHA512
bc6cbbe63f735ce8adf5169ed3f8b3933c0059be085645214885b29c03b88b84065ad80deb651a75c08c97d1667c774e1e46b266b9448fa9e4129f8853dcc984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2428ea2bf03f9ef33f38b0c20d6d5c48

SHA1
c043c928171e39f46613217c145266a194b70bfb

SHA256
26378b68f741b8b0e1cb1f1b66d2c58c283ed3122dd2aad76774fa1b1705df68

SHA512
71e5aca5b0f11e9cacb2a16a1696dd334bad2ea19804db8089e48fe834737e4c37a5090e37a6aa4cd3d71f3631a9c6335dec73433996f0f29eba7ebc2908f4be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
823eac28c82463aa5ce26205a9dc61ea

SHA1
0df01c358f869cbc6165bd1455d2c28ac0f197a1

SHA256
b86c21d8a279a011657beda68f15f212b1c975f2f3b622d437a581d72e5405db

SHA512
9c81220c467c48a63058cabb6c2c59705786f8c0eece50b647c251331cb9eb1fba2c61caed5fc37833b15710ddf8fc082e93144302519bf1e0e56fce25e38f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
021b6ff4a204a920339d7edda0d368bd

SHA1
53d95e5225bb154f1727b738198eac8383d9b8f8

SHA256
40ad5c9430cb4144f99cf99104f98558d66ba3e60bfaad2fb807c1ea6dab26fc

SHA512
9edb6ab92937e801f7a609bd762d3331b38ee7bb3a7fa1d1a8cacc3cc42af572d2dc70af991c186c214f06c4e0b41695a72c1614bb7c4814b4cd9f40db6fdcb5

Download Submit