363870d05d65e2592ca5ef793736be940487bbfd74e22da2736a4a8744bed8cb

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aef39a4a87532bb83a86973f7d2e2a95_JaffaCakes118.html
Size

4KB
MD5

aef39a4a87532bb83a86973f7d2e2a95
SHA1

1087fe15e5013b1068b6f002509b03196c6f96a5
SHA256

363870d05d65e2592ca5ef793736be940487bbfd74e22da2736a4a8744bed8cb
SHA512

a757d8227419cc4b21f00f34eb11bcc4d66f0a083afe3b79d214ffe568c9c012deadab261a8e32d98cafa0bd3d618510ff7360e0efc54fdea5f3d61740c1b12f
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ofVzn5d:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
5052	msedge.exe
5052	msedge.exe
2780	identity_helper.exe
2780	identity_helper.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 4260	5052	msedge.exe	82
PID 5052 wrote to memory of 4260	5052	msedge.exe	82
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 4520	5052	msedge.exe	83
PID 5052 wrote to memory of 1216	5052	msedge.exe	84
PID 5052 wrote to memory of 1216	5052	msedge.exe	84
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aef39a4a87532bb83a86973f7d2e2a95_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb29fd46f8,0x7ffb29fd4708,0x7ffb29fd4718
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14499800074820759643,9558964223759577625,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,14499800074820759643,9558964223759577625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,14499800074820759643,9558964223759577625,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14499800074820759643,9558964223759577625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14499800074820759643,9558964223759577625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14499800074820759643,9558964223759577625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14499800074820759643,9558964223759577625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14499800074820759643,9558964223759577625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14499800074820759643,9558964223759577625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14499800074820759643,9558964223759577625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14499800074820759643,9558964223759577625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14499800074820759643,9558964223759577625,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
cf84c6eeaa98c01865c41755bdcffcf0

SHA1
f220282d533ec77441bfb813248b45f303dc110f

SHA256
32df32254658ae27ad7263b4de3636ca4feec3429983963edb8228b25faa348a

SHA512
1caba192dd75de7ab63b45178b845107c975155976a8f45877f9c4395fa1b67c78b7200936bf4b9620baecfc15032307270178cf10d95a48f8858c283a1ff331

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa34111b8cfd05b210b62b51023ca909

SHA1
67b5829eb3710f1adcf12aedf91ee60c6c422d4e

SHA256
733ba094fc718f6ac60b8f6e4e987cadf36772ca352b5172e77a989e39b8d493

SHA512
068de18aeaa480671a29665b086e41b6d2e360b8067678e38c8ca45fd9ab73fcfcba606d09b4ffccd5c1aa6619e83791c5e0b7d7a01c995f64bc51bf468ea9d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5d64fad0a8e0d78369ed3c1e1e6afec1

SHA1
9500f9c4e942f5dffad24fd2bfac4074dc8ed1a6

SHA256
db54d220a65deea738dd55575bc0349006f916e0c83f0caa3ff33ca84f4aad55

SHA512
2c9168ebd72231844d75eb470ccb0d463e9f502d8dd1d6e9e0dbc06b26522b8ddda3c33f35d87c655bd57ff8b0a9918f786882315da78e879d1d1cc9754ce812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a0ba4046004bab40cbee2bee8a8783be

SHA1
a868874d489ed6337ff195032db3aae80a514310

SHA256
b2ea6a4d06cdf130fb5508ecd01b819f75666f55187801aac8ddf98c524b26cc

SHA512
f7add6d262e0a3fde35f462deaeeadbd72c59a716f40fb4b732f4e9a504c6cae3bedb2157d8878263250644246f4e4d4c71d94cce0ad4424c1a05a6cc580c227

Download Submit