d37d674eb72c35dd3a47700cce0a31ef23f9c2a8eefdc5fe729d468674d0b7b7

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b542199c2ca417fd593e6f6a44644a0a_JaffaCakes118.html
Size

151KB
MD5

b542199c2ca417fd593e6f6a44644a0a
SHA1

a0fae104acc4d28b3414ae621279bdf8b1da319f
SHA256

d37d674eb72c35dd3a47700cce0a31ef23f9c2a8eefdc5fe729d468674d0b7b7
SHA512

098c0e9f877185360533dbd5f9211834989fdb09af7c38dcbde932524e55d1aafe6bf6a5ebe5ccd567e74497674519494280f80fe4eafa6b399e2e8fb60b89bf
SSDEEP

3072:qCKLbdIIU75p/fTAdVD1PeOz9gbpnt9MrI:qCKLbdIIUCPuD

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4436	msedge.exe
4436	msedge.exe
1296	identity_helper.exe
1296	identity_helper.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 1744	4436	msedge.exe	81
PID 4436 wrote to memory of 1744	4436	msedge.exe	81
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4260	4436	msedge.exe	82
PID 4436 wrote to memory of 4704	4436	msedge.exe	83
PID 4436 wrote to memory of 4704	4436	msedge.exe	83
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84
PID 4436 wrote to memory of 1100	4436	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b542199c2ca417fd593e6f6a44644a0a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf5cf46f8,0x7ffbf5cf4708,0x7ffbf5cf4718
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6651210132867394908,5017314333076174325,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6651210132867394908,5017314333076174325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,6651210132867394908,5017314333076174325,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6651210132867394908,5017314333076174325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6651210132867394908,5017314333076174325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6651210132867394908,5017314333076174325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6651210132867394908,5017314333076174325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6651210132867394908,5017314333076174325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6651210132867394908,5017314333076174325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6651210132867394908,5017314333076174325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6651210132867394908,5017314333076174325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6651210132867394908,5017314333076174325,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3312 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\23c2798c-75a9-4e75-b3dd-5987993f6899.tmp

Filesize
6KB

MD5
54ef13f0e3bd952b57ddc4f607803758

SHA1
18a8551f837d40e0d695b94abdfaa4f841d3558d

SHA256
b37512f1dd99f3c6cf7b73ec00a9df99558f578a10dccb158ae179e91f10a3e8

SHA512
4f33958c2a00eeaa2158ddfe472e35634c538b7126fbf62bcd34c87bd1ed0341c52d196f7c1906b81bf4888f76876b9733e023745f7db1b723a0977123ceac2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0d0b5a02b26c1cb59d06e3dd93a7d9e4

SHA1
211e0ccebe8a2996ab2b3bbbb9da0636ece79b62

SHA256
79efe01fc7385ab4e4455e543d0e746de0534971f8986970aecde4f24ac256e0

SHA512
b6697441ebdb6679d32da73192c31dc604cd4017d503a2975e6c58b597243df9cf8f5719517db1c1ab44389af352e11072991a8819fefa56345f1df77f00f758

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
30fc6ccf7a63f3cd1adbbbc058eb86a6

SHA1
39abe25c99e56048be9fede877a75344f8e7d02f

SHA256
98efe1914026e2ae33740164ddc1f7b43eb2c4049a152535604ea4e8c41377dd

SHA512
377f9eddba4632204596f82621777b39061f189792389e621e37d2392da5480f66006498b1745bcc409a5d4da6fb23cad84433d1f9cf4093db79b4bca76de722

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f28a4449003478959ace44fc7ea6b92

SHA1
206879e0049d4a8d6e3a22245b2d2eb62cce3786

SHA256
887d48fcb9a454e61c09f63e1c4dd3901495cc986b50fe12c3e6594907aa71ec

SHA512
8cbb13ddb2a7b04c5f0686e6abe5b8649a234a45bd6341c360ac6fd5e035b2e6df6bc29c0cab56fbf95d3d9f00ec2009ee4f3122ede52cd08bddccdbc416914f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
397d2253e0a7d497972ef30ac487776e

SHA1
2d6833d800827cbe0ab40be70f9e5bcecdda2b7d

SHA256
d72449c19c3a0fbdf8e6aa8a30076cfa975317afee8d6707c7999b205a94b31d

SHA512
d2292de9cad842da969a61f44e9e2e90c7ffe905fef97bc7fb8b2c2e37e3db820a1176f7d13f0a5a1d2da463788e181cf2ce5b0722245659b2208ab9a718402e

Download Submit