54aa8bb04cea50f5a7b0767ba75ed41a0d44bc9e285f38f6d3343dc248320b7b

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

21ec9a6807736abfd374e6431d31399e_JaffaCakes118.html
Size

594KB
MD5

21ec9a6807736abfd374e6431d31399e
SHA1

101f13e4e8ba5d6042214a4b395908255889395a
SHA256

54aa8bb04cea50f5a7b0767ba75ed41a0d44bc9e285f38f6d3343dc248320b7b
SHA512

9deaa937156bda45ec378265d90ac55b73c16639a89260e2489fb081b45e6522f27db7d6a6dc6e7f35fc47c463a1d6f1c296c1070cedaeffa55d4359747fc330
SSDEEP

12288:BF+6VPuBk/wqagynUttBQHD3KuE5CgKcyZ1VApwH8yX+V8k/QxGD:BF+6VPIk/wqagyYt3

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
2508	msedge.exe
2508	msedge.exe
1904	identity_helper.exe
1904	identity_helper.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 4296	2508	msedge.exe	81
PID 2508 wrote to memory of 4296	2508	msedge.exe	81
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 1004	2508	msedge.exe	82
PID 2508 wrote to memory of 3280	2508	msedge.exe	83
PID 2508 wrote to memory of 3280	2508	msedge.exe	83
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84
PID 2508 wrote to memory of 1360	2508	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\21ec9a6807736abfd374e6431d31399e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b7db46f8,0x7ff9b7db4708,0x7ff9b7db4718
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16737934315681048057,8506231169765142142,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,16737934315681048057,8506231169765142142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,16737934315681048057,8506231169765142142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16737934315681048057,8506231169765142142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16737934315681048057,8506231169765142142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16737934315681048057,8506231169765142142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16737934315681048057,8506231169765142142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16737934315681048057,8506231169765142142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16737934315681048057,8506231169765142142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16737934315681048057,8506231169765142142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16737934315681048057,8506231169765142142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16737934315681048057,8506231169765142142,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
43e2994860b28d6bdd67aa6cbc6021d5

SHA1
25458332559e22afce83f981c3fecda0f9c4a9af

SHA256
b67fb8ffd97623d7ac0cecf9db0119de7eddec7dc73bd553040aea0f660f8754

SHA512
aad95e2a8724277b1d5b404b69b70b8b5f6839d40c6ca5ce70cc1cfc10cd4a1fce0fbca18c01766b68eaeeaa61d273d3e02f63eb8d5c71565fa5757081e5f500

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d1ea3a2eb6d79ed9d84684baadf8bcc

SHA1
8fc1d283a144dac957e6659ee9c547c6c46a3f7f

SHA256
168d5f66a59287e775d770f8244105a6b8e96721d0779ffd3e968b6025b999a0

SHA512
0b5f8ed4501b3b21eef1e6cbbc0843517ad3335ce6650f87931f30fa5c494508c6303d86fbf1c84625c744878611fbf1f6888053533ca82e97f99d2e847448f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
cdf4180ffdccf5a09c16b040b1897d00

SHA1
ff73819997d9f1161fec940186ce194076019313

SHA256
f1c58a8b00ca177d8a8f303e09a13dd801bd0bf74b943348e4adb8cf794ebe88

SHA512
e16f860f3aa20adebddead2e278add9af8242ef57657954b27e18f698e8184d47555da9a5a64106773271c1e2638358b48042c225121d8a43a4409b4a6707fa2

Download Submit