af398b459ac82ec66e387edb968701a7bb163562dabe2e8a0d915f2cb4b0f930

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40a68f2ec93f873b6d35230028dc3250_JaffaCakes118.html
Size

108B
MD5

40a68f2ec93f873b6d35230028dc3250
SHA1

9c9e9283c4547e1b61b68e2ca531522a27b329d5
SHA256

af398b459ac82ec66e387edb968701a7bb163562dabe2e8a0d915f2cb4b0f930
SHA512

ff64bf59aa17b806f9630f252b1001ba3ddd6a2513b4b7954c080d67725f72a911fef9eccd41b7c303b9c14dfbc50241b5a1a1cd9ce3d9a193723a0ca06bca36

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
1140	msedge.exe
1140	msedge.exe
3836	identity_helper.exe
3836	identity_helper.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 4456	1140	msedge.exe	83
PID 1140 wrote to memory of 4456	1140	msedge.exe	83
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4916	1140	msedge.exe	85
PID 1140 wrote to memory of 4248	1140	msedge.exe	86
PID 1140 wrote to memory of 4248	1140	msedge.exe	86
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87
PID 1140 wrote to memory of 4116	1140	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\40a68f2ec93f873b6d35230028dc3250_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5d4a46f8,0x7ffe5d4a4708,0x7ffe5d4a4718
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3068835455818528522,17114994578118469492,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,3068835455818528522,17114994578118469492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,3068835455818528522,17114994578118469492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3068835455818528522,17114994578118469492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3068835455818528522,17114994578118469492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3068835455818528522,17114994578118469492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3068835455818528522,17114994578118469492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3068835455818528522,17114994578118469492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3068835455818528522,17114994578118469492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3068835455818528522,17114994578118469492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3068835455818528522,17114994578118469492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3068835455818528522,17114994578118469492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3068835455818528522,17114994578118469492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3068835455818528522,17114994578118469492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3068835455818528522,17114994578118469492,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaaad45aced1889a90a8aa4c39f92659

SHA1
5c0130d9e8d1a64c97924090d9a5258b8a31b83c

SHA256
5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

SHA512
0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ee50fb26a9d3f096c47ff8696c24321

SHA1
a8c83e798d2a8b31fec0820560525e80dfa4fe66

SHA256
d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

SHA512
479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
325b87d21fc8ffd4b0087dbea79a9c92

SHA1
c5e7fd6dbf418a003e3319acabc505a75d1d3c36

SHA256
1bc253fba1854115d9d0327ee4f736b8ae87a959b97a72190c9aeca212c9748a

SHA512
b588c1aa116117fab178a5961dc8e90dd0cde7e2245eba8a3a1911546f726a4895ed0d08180cf0e709bef245427a3cd94a8aace2c876d7a6c82b4c3865a0ab61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3244761081a41be204fccc8f3b3c7ab5

SHA1
d059e943d1b0e06664bd519a971791e463623ae3

SHA256
05bc481c73bfe6159a38292d96aa2fbee7163dfaacdaa3db4ee4ca797c8ca759

SHA512
ccf2943355debafee63225aaff3a1df5bc672944d37f3ee54b0a30653f2575980deb8beaf108a339f4a887579cd7b7e0ce8e4e206a57094cca645670c6eb1166

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa420eb8f0fdcf909b134a2ab963d612

SHA1
d3b24dc26f3a64bf3689562e4cf1059c147f0e22

SHA256
3aad3967ceacdfcf06a464579c1bca201e7e5c1dd5edbc68cf37723978c949b3

SHA512
bff40b69586c0117151f3bd2ff087895de15243c7d9b8f547313e1d9eacb6362c8360c407b95aa402da02ac67c062dccf452f3cbb3b7be35681fdf977032b516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f570bc29c502172ea719c7f52e8227bc

SHA1
f7edd47919b7e28637e4dfbc9fd39eceee22cc51

SHA256
9967dae222eb9532e1ad1e7e13c9369b1c2172d75b0c7dde5e599e274dc9d2a6

SHA512
09bb3ae2d9d31703b9eff3f91368c107529acf4ed6b7fb720f6b83051da368c0c488c476d362e56b893046d73a74089f56417cd274017587b5a626a7c8faaf9f

Download Submit