d09b38c1d695dda44ac4edfc65b97856e7eb949ae5f2ec4eeed3eb35139f8c56

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3135545d6ccbc9ebab301906e1125a14_JaffaCakes118.html
Size

57KB
MD5

3135545d6ccbc9ebab301906e1125a14
SHA1

548b9385fafd10eef231b9503154b8de4c77a947
SHA256

d09b38c1d695dda44ac4edfc65b97856e7eb949ae5f2ec4eeed3eb35139f8c56
SHA512

e6fd8dfa3ae50aab0adcf906ae84e2e8cf1d4348d9653f73e84e15d8f7f67a5d39f693603e9410c825298cbbf0f049467d0f0c37d2497ba736f07d8d3be6427c
SSDEEP

384:OB0lYEp2Lb2Ox1L4GRgy6I5bquLpGnV6PajkpiW6oRLoF8oPqomIigxModR/VZab:qhpjxpZrXzew

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
2384	msedge.exe
2384	msedge.exe
2680	identity_helper.exe
2680	identity_helper.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 4796	2384	msedge.exe	81
PID 2384 wrote to memory of 4796	2384	msedge.exe	81
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 1016	2384	msedge.exe	83
PID 2384 wrote to memory of 4620	2384	msedge.exe	84
PID 2384 wrote to memory of 4620	2384	msedge.exe	84
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85
PID 2384 wrote to memory of 3084	2384	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3135545d6ccbc9ebab301906e1125a14_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91d1546f8,0x7ff91d154708,0x7ff91d154718
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,6219810402219906480,3557407057967911940,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,6219810402219906480,3557407057967911940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,6219810402219906480,3557407057967911940,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6219810402219906480,3557407057967911940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6219810402219906480,3557407057967911940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,6219810402219906480,3557407057967911940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,6219810402219906480,3557407057967911940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6219810402219906480,3557407057967911940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6219810402219906480,3557407057967911940,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6219810402219906480,3557407057967911940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6219810402219906480,3557407057967911940,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,6219810402219906480,3557407057967911940,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5faebc7fcbb457d528b98d9858d9326d

SHA1
12fcdc1303853bc38cee86dd7e61f364450bccb9

SHA256
710bd6f41b4bc8f598f9e012f82985567f88a72d7cdac2ca5155dee8f7197230

SHA512
7ad7fdbf8393e9ff164d9c0d4bf75f9b28c3a3f7c5cbecf13f1e31572f63009abb2da79b94af0b4ac1b7ed822dd3c9d20e32663dbd91c904725e2bb11e884a75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88d34ba73c068d826511b461751fe189

SHA1
e1310c1a2e0646709bacb8c73500e18088b6a6f3

SHA256
89947bf59b5f07905cc3aa891c0cb42dcdfc5b06a3a482301cbf8c7bf6c01238

SHA512
39fcb8e0a0deb19ae4b63ddb32043bd64eb34d11bca1dc9fffcb668b7b8c955b44c2333f617f240e8bdcff5f4cad35b298378dca5295d5ad7fcc21c7195d102e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
28cca912477dc7c2a4a8edb102518e5f

SHA1
c595b41863d3fe6fc63a31ed14dc5d78722da6b5

SHA256
066b190f5675056683e2678b1fe74ed418662cb11d597f5b9ca3e6c632ee2fe6

SHA512
5905c8f6b9f1c6625b3ce8e7f5b190da1898e0b13618639bb112d675d523912033aaf2d91af37ea3241dae1516f8486b2ab7694f2363a92d00bbb673e68ea14e

Download Submit