46aa41d00606e9067d0d13f08590c96da0087c9f21aa2ef82d399ff5f982dce1

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b31ca56b85afb2a6433fb06789e52ef7_JaffaCakes118.html
Size

53KB
MD5

b31ca56b85afb2a6433fb06789e52ef7
SHA1

6117afb44eefc3854d1d978df53809c0a3b37baa
SHA256

46aa41d00606e9067d0d13f08590c96da0087c9f21aa2ef82d399ff5f982dce1
SHA512

673a58899ecf9a0ee03c54f10712652aeb17c4b8d08b044057c263287241d5034299eb95214a63e7892e4f8183eba8c4e95976acbb0f92eeab47e0472786ec25
SSDEEP

768:QLnd3LAPWZ2mTOsTa2ueO+HThjYqFtDtDyPlyYEVnTZaQCZW6QkQ6f+gH:Mu+HThjYqFtDtDSSkQ6f+gH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
3020	msedge.exe
3020	msedge.exe
4468	identity_helper.exe
4468	identity_helper.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1928	3020	msedge.exe	82
PID 3020 wrote to memory of 1928	3020	msedge.exe	82
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 4844	3020	msedge.exe	83
PID 3020 wrote to memory of 64	3020	msedge.exe	84
PID 3020 wrote to memory of 64	3020	msedge.exe	84
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85
PID 3020 wrote to memory of 3336	3020	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b31ca56b85afb2a6433fb06789e52ef7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5bc746f8,0x7ffb5bc74708,0x7ffb5bc74718
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,12415506155006386846,4704333064733566593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,12415506155006386846,4704333064733566593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,12415506155006386846,4704333064733566593,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12415506155006386846,4704333064733566593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12415506155006386846,4704333064733566593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,12415506155006386846,4704333064733566593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,12415506155006386846,4704333064733566593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12415506155006386846,4704333064733566593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12415506155006386846,4704333064733566593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2520 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12415506155006386846,4704333064733566593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12415506155006386846,4704333064733566593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,12415506155006386846,4704333064733566593,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
703a6bc703141416ea7315c9ad83e972

SHA1
7e3dc5cc12f1f942d961c0c0877f7d5b61778d35

SHA256
ac3fdee43c43491ea0e5cdfbec585f061aa8720757c844e6d5af9487cdba9c83

SHA512
09096c23a2cdb71921dca8534a6b3477d9acbc8b946fb6e28249d5783c62b7abacf311586797ebda9ea45aca2aad349dfc4a8bff1dbe3f510fd3e29b60241920

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
06529e6cedd825afddae7adcd6122c3c

SHA1
b188416dae3931b6304166beb62731ac829e0fbb

SHA256
4cfe1368c76847a16236d4f7bd6b0ca534c60a39a9cb457d855037a491e087ac

SHA512
bda1778b79545df03c7cc0efc74d43f999b376b99740683c1c45abfa1b558919a5ffb134024ce078cc390e75cba1fd9dd73ee5e51284aa7766afff2763666708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9baf1267e95ad33b92b1497044e7a445

SHA1
2500374c13db1a10b56390a75ae0ee20d50e79ea

SHA256
1a69da8e953c3f0e786d0e13394a81c369bbb348f9b002f7e494b2dda01c4584

SHA512
34e915979eb2d2b3c879d21414dd8e5463ed381d9256de307a659674f21af8a316438a597e9aed929ce44064ab6f6089a2975776834b409fe774564f02398355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3081eaebee89e7e1bdfcdd03a1f949b0

SHA1
a17b44b71e9c989f67eab2a84a4e8b64f622eaea

SHA256
5d901a11bd46f61d3c973c82a112ac09f1adb9f567c3e1b2535b1b630b289772

SHA512
b829ae003e6f45f07692b89c16de2b4600f4d923c4645bd01d0de4957365241ce412f1fe8c193616d254b64cdc21594c9f8ab36d320f00707bd6a07c5e654305

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1efdef7262a2836b371adfdff0c3783b

SHA1
59703a9cb5e7b388d1d3f2eae7556b1a6c913650

SHA256
69c31c0f46dd3ab7744b31385fb7530bc8a8055df3f16ce77fa20df0f9376385

SHA512
6148cabffd0cc7fda0352ae1893256b69ded07946d6925bf51776e6b0c1ac1ce95b545b3df0fbf4193898c7107b6103f93ea1252305527cf93f724a1e7acce8d

Download Submit