d51bbaea5bb4d8124780bcf4dfefcf2c85b0ee29e3c81c2959b01236741b201d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 04:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bee219f2ff771937290dd0a24ad92f4_JaffaCakes118.html
Size

13KB
MD5

3bee219f2ff771937290dd0a24ad92f4
SHA1

b1002ef581476944e9dda3f7531b3296e1677612
SHA256

d51bbaea5bb4d8124780bcf4dfefcf2c85b0ee29e3c81c2959b01236741b201d
SHA512

fd0476c755e7b51b1f3b869d90bcc625ceb9e85b6c94fd597fef9db212eb2886bdbd9bd2a55ce1e09ba2a58f28a60051f41f87a65dcf216dac9a106f5c2d6f6b
SSDEEP

192:RNKsAgAnAc4q/FXY3OqZQEwofuWi925EQEvYBZBO5YrTgs7mP2EeQtohs3jHLj:OhgAnDY3tQ4fbiE5MYBZBO50SLj

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
424	msedge.exe
424	msedge.exe
4960	msedge.exe
4960	msedge.exe
3332	identity_helper.exe
3332	identity_helper.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4980	4960	msedge.exe	83
PID 4960 wrote to memory of 4980	4960	msedge.exe	83
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 1380	4960	msedge.exe	84
PID 4960 wrote to memory of 424	4960	msedge.exe	85
PID 4960 wrote to memory of 424	4960	msedge.exe	85
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86
PID 4960 wrote to memory of 1212	4960	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3bee219f2ff771937290dd0a24ad92f4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3e6046f8,0x7ffc3e604708,0x7ffc3e604718
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14818211626158963816,18094359780609209484,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,14818211626158963816,18094359780609209484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,14818211626158963816,18094359780609209484,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14818211626158963816,18094359780609209484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14818211626158963816,18094359780609209484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14818211626158963816,18094359780609209484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14818211626158963816,18094359780609209484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14818211626158963816,18094359780609209484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14818211626158963816,18094359780609209484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2608 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14818211626158963816,18094359780609209484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14818211626158963816,18094359780609209484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14818211626158963816,18094359780609209484,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3960 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
303B

MD5
f101d05666fee2fa8b40ee63bb57f41c

SHA1
ab7c790412abed9df4084d7770da4ac1f25655fb

SHA256
15a8054b48378acb1c89cee687f0b664fe59fd0e06f8a48fa4f010df602712ae

SHA512
ec15a13fc9261f3cdc9e41d6e8324d8a1814fcbcc7a3f5cba6985dd591ec1c929746123985b08c631b17bed7c7edadd0c79d851596206b597e9d39de682189e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
61f0c5f769dff3f5260d6e0c860d0bdf

SHA1
36ba97226d784c2acca9b1c0d5e9e85b65eaf866

SHA256
06fb5810a176ca35b5c222f648225737a3304752ac070a7bf7807873405964a5

SHA512
56413b2d180c6c7324928d845927a741580284b0bb6dbfa8614a306a94a2cd98a98d6bbeb6d41492ac3839095fde8faf964c1f659cf59322653445ad2faae627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
246bc74e36cd0349d067d715889ffad8

SHA1
a92d52035d1bac190e90c2099e32f6018fcab0ed

SHA256
e541fc99b3e288c4eea14940987531164ed7d1d969be7a5db390e2d429af4f9d

SHA512
d538fd2b7a67ffe89e9f14e6166eea9d3fcba44330115547d07578a34803f861472360a7862bd20ada4972e7fdded5e7cccb1fa37652aa3c7597b6e9df00b7b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
63e3daae73308582d09a00d647c79509

SHA1
98e444888083840d129641a3a778cf107bd228cf

SHA256
232a9fe10b1e1405f1e4833f339d0b9f28b9282ae14e14ed408c8e4448562b12

SHA512
421da636b5602c34cf1ecffe2a5b7c4e6a5a277e0b20553c45985049df7b87277f252ac07565bf07540b0f393d2643138dda903dabd06556946f6a79127c8009

Download Submit