3233ecea0e18027458c33a120212c7837afb86e61db931c9b0cdb2414ad95043

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af22100ad4fecaf90637ac65be26d1a1_JaffaCakes118.html
Size

27KB
MD5

af22100ad4fecaf90637ac65be26d1a1
SHA1

ab4ab1951c4f59afef715da08bc445a7880ea128
SHA256

3233ecea0e18027458c33a120212c7837afb86e61db931c9b0cdb2414ad95043
SHA512

ceefbc0436400606bb49dc2b288adffe88aa1b2760cbc2df0740a8ca50610ab6478b9f4cc9de358a0354c1b621c01a250a68ebedfc0352ee8c12a4ca2a144d6b
SSDEEP

192:uw/Ab5naOnQjxn5Q/pnQiecNnTnQOkEntnPfnQTbnpnQ9e+0m60BUSQl7MB8qnYa:jQ/pvMmUlSm5C

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
2132	msedge.exe
2132	msedge.exe
4244	identity_helper.exe
4244	identity_helper.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 1540	2132	msedge.exe	83
PID 2132 wrote to memory of 1540	2132	msedge.exe	83
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 4780	2132	msedge.exe	84
PID 2132 wrote to memory of 3956	2132	msedge.exe	85
PID 2132 wrote to memory of 3956	2132	msedge.exe	85
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86
PID 2132 wrote to memory of 2716	2132	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\af22100ad4fecaf90637ac65be26d1a1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef94246f8,0x7ffef9424708,0x7ffef9424718
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,15147601960659705342,4265540347098279538,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,15147601960659705342,4265540347098279538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,15147601960659705342,4265540347098279538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15147601960659705342,4265540347098279538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15147601960659705342,4265540347098279538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,15147601960659705342,4265540347098279538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,15147601960659705342,4265540347098279538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15147601960659705342,4265540347098279538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15147601960659705342,4265540347098279538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15147601960659705342,4265540347098279538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15147601960659705342,4265540347098279538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,15147601960659705342,4265540347098279538,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4684 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ee86c0a72e85877d3ef97e3e3b222bb5

SHA1
ca8c2621ea0a690a4d0a71b319ba4b9bc9e6f338

SHA256
e092aa00bc7a611c4bb59bab2529619d9c3b79277962b37947069b6fa100249f

SHA512
344f232ba7ceb07eef0c0fa7527f5b578110b2970fe69d66d8f62e3f9be4fa0bbdd79c545f3152ebbcb961dc426a18ede222313c9bac2958552b847e52c7b408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6d7aeeeb8ce226370c3b6b3aacf817df

SHA1
177e94b6f26caa6e1540b35b3280e0721fd74faf

SHA256
61ea0efef335de485254da43bcf5bf655d956e1e6bad87a9d533dbad891a7aeb

SHA512
9bef7461aedb74b7b97b33463ef898a381ef15683d1a13d578575b9b1e9f0943d651fcde85ae946d34feb894518ce7346c7378d6671a64be6d48c597609df386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
ec22087de5dec2068e25eee7dcae8d17

SHA1
249bbd78fadcb1b3dc9657543310e1acf602b4e0

SHA256
3f70703473711b4e68476844056df07e6aa2315e0c9f0a249b6258ae8dcad5b0

SHA512
63a12ae316383148048da223fc23b2ade1a7c6d023451923b6b8f44bbdd932cd96315d371af44d8d6e7d25bc2ea8f09baaa45f557771702c9761aa9cdd39014b

Download Submit