1b9cfc81d121c44b766ed72623cbfffc3f6272669412b143977ac57fdd676300

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17a2c9dc988040fb5a8d3152636dca40_JaffaCakes118.html
Size

53KB
MD5

17a2c9dc988040fb5a8d3152636dca40
SHA1

c3207ef23c4346d3726a5f31b09db4e8262c6973
SHA256

1b9cfc81d121c44b766ed72623cbfffc3f6272669412b143977ac57fdd676300
SHA512

336d2ff6efa9ca716c991bf5395e733eb51176ac018d1332a9c7d415c4b47c9bfb380a23eb614713e6e2ec29a507359cde0b8d1fa28090fd9791fd6c0b93f0d3
SSDEEP

1536:CkgUiIakTqGivi+PyUSrunlY4O63Nj+q5Vy0R0w2AzTICbbdohy/t9M/dNwIUTDc:CkgUiIakTqGivi+PyUSrunlYn63Nj+q0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
672	msedge.exe
672	msedge.exe
1008	identity_helper.exe
1008	identity_helper.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 4700	672	msedge.exe	81
PID 672 wrote to memory of 4700	672	msedge.exe	81
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 776	672	msedge.exe	82
PID 672 wrote to memory of 64	672	msedge.exe	83
PID 672 wrote to memory of 64	672	msedge.exe	83
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84
PID 672 wrote to memory of 2328	672	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\17a2c9dc988040fb5a8d3152636dca40_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9278146f8,0x7ff927814708,0x7ff927814718
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,1735690723673281886,9383539327091989456,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,1735690723673281886,9383539327091989456,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,1735690723673281886,9383539327091989456,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1735690723673281886,9383539327091989456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1735690723673281886,9383539327091989456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1735690723673281886,9383539327091989456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,1735690723673281886,9383539327091989456,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,1735690723673281886,9383539327091989456,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1735690723673281886,9383539327091989456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1735690723673281886,9383539327091989456,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1735690723673281886,9383539327091989456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1735690723673281886,9383539327091989456,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,1735690723673281886,9383539327091989456,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
403B

MD5
d845018f5965314fec066f501dbc5de6

SHA1
ba8f73881a4748cf7b05700a90587760a254cabd

SHA256
a0fba5ee48d8d98b5f200d4f3096e123c3faf17df07eaa46bfe7e4bc3645d31a

SHA512
129592c70cec13ea207d0f5c7d60dfce4331b3cfed81fab1165163cb3e665d52704dacc703a2e0754ba36913bff13ccecdbcfe3732fa51c240fb5ec03639195c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
27239335ab923665e67d087397b7f35c

SHA1
5060e0414585e9bee20f4bbbeeb832c7ccaf64c3

SHA256
daa65b35b177725c5bcd55cad9132410deedf35332011737459452bcecd3d707

SHA512
cf223298cabef58846a1145bc13416853db72c52f99338862ae764143a7b329482e977869ef2d21dd999b56441948dc96c8e9c51aa77d010a0502834fec4d8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4470be5f0557a5c867ea7cc7fbab79cb

SHA1
92782772daf8c4c9a63dee76f2483d3e43cd2349

SHA256
b00d6c1b7105459e1295392bf592a38ae202712fe1581238dc132aaf4ad6440d

SHA512
e528263ef6e1d454ddf535f800e1de50c2e8846c032760b8486d87aa49288744f5b30702d3e684d69e8d7467b3045ec953baea8713b03fa4a0b71c26c5ea898b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4826736d762896da8d154fa8508a16fe

SHA1
9f6bdbf54bf4d5b85d4457fdf43d3ed0d6665963

SHA256
6ef6a1b0ce2d076cd37de35f6847fb03b9e0635a0f315e34301a2b3e52f54fdf

SHA512
f7e66860cb2a3f07f491d71b072455adcb3ff64934e5160ea22159353349382ce09eeea69ed68c7dbbd8ff0cf141194d92099e15d799ac44394549a4d60a1884

Download Submit