dd250e4affb92dae1fd9dbde9652a9857fd73cc398026da1d3416c1cbf84de6c

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab1e9fbe99a04c4b4909fda4ea7458cb_JaffaCakes118.html
Size

8KB
MD5

ab1e9fbe99a04c4b4909fda4ea7458cb
SHA1

581b848ce1be40d8fb235afd4b385bd6fafdd578
SHA256

dd250e4affb92dae1fd9dbde9652a9857fd73cc398026da1d3416c1cbf84de6c
SHA512

45518f2845eda39f7c2f88df5d337dd8915c1a806f9f8b231539a801c2c7ebb0dcabe381d11b10a3f19fbb816a1c3b1b9e18c977f8a62b47beb2c261adcdb6f3
SSDEEP

192:PN4BCp9B0/eq0UVdXjsLA43QDELQFRboaxW5HQucVODMUg:Xh0/ezUzjsLf3B2bZ0ncY7g

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
3788	msedge.exe
3788	msedge.exe
4600	identity_helper.exe
4600	identity_helper.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 4680	3788	msedge.exe	81
PID 3788 wrote to memory of 4680	3788	msedge.exe	81
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4512	3788	msedge.exe	82
PID 3788 wrote to memory of 4692	3788	msedge.exe	83
PID 3788 wrote to memory of 4692	3788	msedge.exe	83
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84
PID 3788 wrote to memory of 668	3788	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ab1e9fbe99a04c4b4909fda4ea7458cb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c3c46f8,0x7fff8c3c4708,0x7fff8c3c4718
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,6198881829212724807,4930297756611451222,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,6198881829212724807,4930297756611451222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,6198881829212724807,4930297756611451222,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6198881829212724807,4930297756611451222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6198881829212724807,4930297756611451222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,6198881829212724807,4930297756611451222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,6198881829212724807,4930297756611451222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6198881829212724807,4930297756611451222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6198881829212724807,4930297756611451222,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6198881829212724807,4930297756611451222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6198881829212724807,4930297756611451222,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,6198881829212724807,4930297756611451222,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
55236c38211f437c1cf2b6f0a558310e

SHA1
41dd7c87539caa0175d91de4087f91c6cb9e11d6

SHA256
78b51fcc14cf0893c5d75aa991743ca0a661f64aa3d38932cb8d3c2cf9dc74a2

SHA512
1717388fe560dab513634ba64d32b8c6e4387cd19cac861ad3e3827250a80560c1bd1d9c06c7d0ab7b1c027f21a3cd9f898bb740cd5252b125d81e4f551b766d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
82c485ecf0a6cce6c25a6e49bfb47e24

SHA1
f14564e3b4b12c81ecd7e35ded92bcd4a4ace8af

SHA256
14b5647736a551ffe5549d64533af56df3d76e9558343dcfdca6b40c268d7688

SHA512
80863287fc0f1531e4fc4fa6340e773fede05c0a6b2072e975a67822cebc9bb522342056e3110a202f5949c465d7600f46d044df81f7d30ce36603aa77a02892

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d42b155529dc7bcd6a51a1567ba29cbf

SHA1
0693032269df7902c7f146c807e3f11cd23c8665

SHA256
dee327ace6ded33f026495b091d8e09ee6633268409c580dae2833eb543f1285

SHA512
fefe95764254123d67b66e762dde4cab17bfce41dad9f268a664d5181821ffd7237285defa51c0af7d4ba75f18371dcbf3fbe8e144b753a8b3394380b224738f

Download Submit