6097e262c0da64c5d98508bed15b7cf7fb0cacbf30953fcebf128283408efdc8

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e0aae4e91196a0c619a535ba9f4663e_JaffaCakes118.html
Size

37KB
MD5

3e0aae4e91196a0c619a535ba9f4663e
SHA1

0d2c51dab3aa0eb68b645fea4db5e77f25c2ae58
SHA256

6097e262c0da64c5d98508bed15b7cf7fb0cacbf30953fcebf128283408efdc8
SHA512

3187fb3f812434e576566f7e290e254020161bc70d031961ab0d431d13fc7b040fadc71e1343d4f92482b4f19610fa09f9bd1a151aa03700f8542e92c91830cf
SSDEEP

768:3WVvUYXHMVFustOqOViNjafvZQoWFVzu3XS:GVvUYXHMVFustOqOViNjafvZQoWFVzuS

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
3364	msedge.exe
3364	msedge.exe
1412	identity_helper.exe
1412	identity_helper.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 1256	3364	msedge.exe	83
PID 3364 wrote to memory of 1256	3364	msedge.exe	83
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4596	3364	msedge.exe	84
PID 3364 wrote to memory of 4044	3364	msedge.exe	85
PID 3364 wrote to memory of 4044	3364	msedge.exe	85
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86
PID 3364 wrote to memory of 1908	3364	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3e0aae4e91196a0c619a535ba9f4663e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff8001546f8,0x7ff800154708,0x7ff800154718
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2268,16780625084239076996,16209310282449763551,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2268,16780625084239076996,16209310282449763551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2268,16780625084239076996,16209310282449763551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,16780625084239076996,16209310282449763551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,16780625084239076996,16209310282449763551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2304 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,16780625084239076996,16209310282449763551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,16780625084239076996,16209310282449763551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,16780625084239076996,16209310282449763551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,16780625084239076996,16209310282449763551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,16780625084239076996,16209310282449763551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,16780625084239076996,16209310282449763551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2268,16780625084239076996,16209310282449763551,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2f842025e22e522658c640cfc7edc529

SHA1
4c2b24b02709acdd159f1b9bbeb396e52af27033

SHA256
1191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e

SHA512
6e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54aadd2d8ec66e446f1edb466b99ba8d

SHA1
a94f02b035dc918d8d9a46e6886413f15be5bff0

SHA256
1971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e

SHA512
7e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33f99ac46bc2d4bbb526b69812502045

SHA1
4eb245834f21010fdfde865565f1e3e8d492d189

SHA256
47aa53f5464e71dab71ffec07e3b217038f68731efd1122c77e94ba08818d637

SHA512
fee38b818e1ab154fb8b8ec3607e1dc8d002dd815fb72b5a7516a77f91c0e93a95110f469265285cf50d5b94607717191289e2d5a2a0ba3b5e8cae93f0d30396

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a17bcc24fb014a8cb8f364f826e58891

SHA1
fee4c33f0417e41ab53aa25d505c6c8779428da8

SHA256
51db1ac426d09226c2c79f342a6df55615fc8f61128cb8ccc4220f8d5d40c8f1

SHA512
0203dbf4ac45d8a44b171a2804cf9aea9262ceeafb485a10cb547ff7f68f9da633a3c9f897b7f66c01489f9d2f758b415eee3ff552afe1482f968b451ceb394e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
899721cf1465704d6101d9a3516e8055

SHA1
7938d9f694ae1b76b2fe4ad1445d295ca9c421ce

SHA256
4e296f52a8d505d1c9b57953b5986653cb0cb1b0379c45603efc57b34547380a

SHA512
0b6b354e63ed55808e07f9a9ad9745ab3b4fd974a30e1d9fba4e613a0efe8680216a279acf09274892a287ca314202a7fc14cf99b1f41d03c208b9c8603f007a

Download Submit