d72f8808b166d0b892477cd21fc8bc8ea384235b62ff43d30b23d693bc2c1bc2

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3502fd57795594498c6fe51f7a08c42_JaffaCakes118.html
Size

53KB
MD5

b3502fd57795594498c6fe51f7a08c42
SHA1

c2bd96c79470fe1be5b8c19f208ba3b2df510598
SHA256

d72f8808b166d0b892477cd21fc8bc8ea384235b62ff43d30b23d693bc2c1bc2
SHA512

450aa5db262f0e0046655dc8a3d445bcf68b696c47a88405ccb13686420d9778131ba4ecee23f2eed0e93987ccc87d26d0d4d647902d26264e9c3f46f88c8e3d
SSDEEP

1536:TqKCfNOMJnBfDr/Hqhu9RqrIju7wCW1JyodWsG1++J40jnqWoXUqmQaE:GOMJn5DDHqhu9RqOxpdWsG1++J40jnqX

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3648	msedge.exe
3648	msedge.exe
1396	msedge.exe
1396	msedge.exe
2584	identity_helper.exe
2584	identity_helper.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 3404	1396	msedge.exe	81
PID 1396 wrote to memory of 3404	1396	msedge.exe	81
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3460	1396	msedge.exe	82
PID 1396 wrote to memory of 3648	1396	msedge.exe	83
PID 1396 wrote to memory of 3648	1396	msedge.exe	83
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84
PID 1396 wrote to memory of 2200	1396	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b3502fd57795594498c6fe51f7a08c42_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9bf9e46f8,0x7ff9bf9e4708,0x7ff9bf9e4718
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16685873383897512954,14843379800104006004,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,16685873383897512954,14843379800104006004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,16685873383897512954,14843379800104006004,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16685873383897512954,14843379800104006004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16685873383897512954,14843379800104006004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16685873383897512954,14843379800104006004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16685873383897512954,14843379800104006004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16685873383897512954,14843379800104006004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16685873383897512954,14843379800104006004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16685873383897512954,14843379800104006004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16685873383897512954,14843379800104006004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16685873383897512954,14843379800104006004,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
477462b6ad8eaaf8d38f5e3a4daf17b0

SHA1
86174e670c44767c08a39cc2a53c09c318326201

SHA256
e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

SHA512
a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b704c9ca0493bd4548ac9c69dc4a4f27

SHA1
a3e5e54e630dabe55ca18a798d9f5681e0620ba7

SHA256
2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

SHA512
69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98d9b421186b1048dd05e599c186ed99

SHA1
28a772f4d0d0670673f9d92109465d52538d4843

SHA256
3a87ca6c53acd5b46a4f8be478973effea90de9fa8b1c34817f6b902811006d6

SHA512
5fcfc23a658015d8637a262fe17f351888bca280914054017c9ab4054829da09489cf91187feec79f74a9461efd7125e78f5be44a263cf9583e7b6c56637b9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
23a14857df70a461579f5e2716daa1fa

SHA1
771dd9ac80d83d407d2883dfbcbf80ea7c6f90fb

SHA256
aea48e0b1f2b71fa73a2ad58ee4951f65c07a5eca80077cde67a52adb260c9d6

SHA512
a769de365da6432a54fb59897efc2e65fcde3c91e28ba59fb3144cb58ca8c39e6ae245f2e49b47ffce31618e5278a95f0801d097af97c508d60ac70b0a941118

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e15b2387a77a1b9a9022274f0f9c1937

SHA1
a69c55663c40132abb8f8f9af9a85cc3133b4a53

SHA256
5fa70416d19cdcbf3db13e2d90269dd5908bbea38bc52e0212b81352f553cd60

SHA512
57773a0703fd5c74254d12139d64e4c10b813c0175ba83e9d02ec93f59e46d45ea1ea3fedcde9ccd94f782433904e56143ceeac6b52bfcf802d5504f3c30fabd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
adb88fd8a69cb438fab16fa9ce17032b

SHA1
d62546ac491de9d7688e90be8a7d270be3f6df2c

SHA256
83d03b97158f8042e4e47fd02a565e4a9f96c9bda919633d09ffb174b6577e19

SHA512
55f1e6f7de64eff92668bd0db064278c5d76ee2aebee79a69a7bf550f36daa43510a7fcefc7b17581eaf84ed1517a0ba230c469a56b1de27f861bf0637307733

Download Submit