77378864dc65002f1faf9a9df9ec74ddcd79c7ceed6ed1a38057372831697e89

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4dbc5cd95949d2269f647c6108b5c4c_JaffaCakes118.html
Size

353KB
MD5

b4dbc5cd95949d2269f647c6108b5c4c
SHA1

6abe7cbd772ed172510480ad9c6c2edc6167287b
SHA256

77378864dc65002f1faf9a9df9ec74ddcd79c7ceed6ed1a38057372831697e89
SHA512

3a4993716cde101c74df264572ed11b1c24de5611de5dafc076f928adb8a879ba686a186fa25a6fb07905d05cf0d05108629b6c5b0ec2f88c728b1935c328a95
SSDEEP

6144:dzjsMYod+X3oI+Y0hVSsMYod+X3oI+YGsMYod+X3oI+YQ:dz35d+X3+hi5d+X3u5d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
3444	msedge.exe
3444	msedge.exe
1360	identity_helper.exe
1360	identity_helper.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 3220	3444	msedge.exe	82
PID 3444 wrote to memory of 3220	3444	msedge.exe	82
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 4284	3444	msedge.exe	83
PID 3444 wrote to memory of 700	3444	msedge.exe	84
PID 3444 wrote to memory of 700	3444	msedge.exe	84
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85
PID 3444 wrote to memory of 4392	3444	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b4dbc5cd95949d2269f647c6108b5c4c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff956ee46f8,0x7ff956ee4708,0x7ff956ee4718
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,11035157937898779080,13410105184971469150,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,11035157937898779080,13410105184971469150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,11035157937898779080,13410105184971469150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,11035157937898779080,13410105184971469150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,11035157937898779080,13410105184971469150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,11035157937898779080,13410105184971469150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,11035157937898779080,13410105184971469150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,11035157937898779080,13410105184971469150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,11035157937898779080,13410105184971469150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,11035157937898779080,13410105184971469150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,11035157937898779080,13410105184971469150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,11035157937898779080,13410105184971469150,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3912 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
18ddde878f59a969b7d0370ea5076808

SHA1
991b08e3c427d1a0d0fce1e82b3632bb93080086

SHA256
3a9826b55c222163dcad339e20ded1692af48f04dcbf0fd4b871a9fbb4cc9c65

SHA512
a69229973ce52be4ace86d7bd9477e619ec105258f4724f302772f78ad068304dcd537e92e79faa60406a6cd8a22b3d3c9460527f0e026a548836b92ee9a460e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dd87bb0ad10f388929262d3d10ffb6c5

SHA1
58859a86ee5cd63c246154f618dea0fb411d4441

SHA256
db125b7904ec144ec8034f6da0c69c38d5d61b16ec72438a63c4f2f9ccff2cae

SHA512
d35d0853ebf1c4c900b5ee680dbc7ee71ea069bc4d3b1bdbf91d73fc46ca1763081e734356456f4b586d8c5ca236ab6b5d55d759f66bc23c8e5591750195144a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
f3fd7a8630c3a1479bb090df652c8749

SHA1
ae6c113ba063a4d45917f4bea9160a9e35681d23

SHA256
448fc138e75aa3e6bd9b399ed44f3f8073c4a6f57c8f912a32a17069aa9bb189

SHA512
8a96de4a5120876bfe2fe2d68ad0812143660baf477ac2ad337eeb19aefe7720b28574218a60573cc918fb4752f4159924e0d3984ae9446eb83110905fb5150e

Download Submit