07f167c2420571400cbee1a9998e25f4955669349e2fcd937cc103bfb9cfb4b8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 11:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4169059f2455271af0fc0bd511b5a50c_JaffaCakes118.html
Size

11KB
MD5

4169059f2455271af0fc0bd511b5a50c
SHA1

56140ed18a60aaea4686c11eb1a43b1e07d46408
SHA256

07f167c2420571400cbee1a9998e25f4955669349e2fcd937cc103bfb9cfb4b8
SHA512

0265c8e42fa28ced907302d0f787a8972a3e8a584ed151589a56524348330f6223dd1c71af30789b028341234f032034749e0758f338827b49fc8fb01ddc0e20
SSDEEP

192:phKrGVX8jNvidG3FmnhdInDCuycnQ4zng83nQvFfpQE+GAEM:phK0XYNqSW6y88y

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3620	msedge.exe
3620	msedge.exe
836	identity_helper.exe
836	identity_helper.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 5068	3620	msedge.exe	83
PID 3620 wrote to memory of 5068	3620	msedge.exe	83
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 4124	3620	msedge.exe	85
PID 3620 wrote to memory of 3752	3620	msedge.exe	86
PID 3620 wrote to memory of 3752	3620	msedge.exe	86
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87
PID 3620 wrote to memory of 2992	3620	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4169059f2455271af0fc0bd511b5a50c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a68146f8,0x7ff8a6814708,0x7ff8a6814718
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,7656578856474848356,5152897173858483972,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,7656578856474848356,5152897173858483972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,7656578856474848356,5152897173858483972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7656578856474848356,5152897173858483972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7656578856474848356,5152897173858483972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,7656578856474848356,5152897173858483972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,7656578856474848356,5152897173858483972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7656578856474848356,5152897173858483972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7656578856474848356,5152897173858483972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7656578856474848356,5152897173858483972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7656578856474848356,5152897173858483972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,7656578856474848356,5152897173858483972,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19a63b21f087957dd70a00e5ced83b25

SHA1
085932ca28f759a0ba07b2fe049344722f1d15b6

SHA256
05758e0d5b14d8a7ab8fc610f682727f0a78b96047494815f88979f84a3dfd35

SHA512
15fa40d3da971d4eb73413d99a74f0b2171829f50534e20f1150953d35711b3ef8425942cb511c2421ffc3054af0fe2485f132d32fc509c00f8ad496f421ec60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68d33a0d3476095c62d22071844acd76

SHA1
62a9d7f784694eec13c8bccff36a5ad7b584dea7

SHA256
f02d302c5a6543edae70fbe44107c96f5a3f6975718ae8283f8cd08e36257579

SHA512
a61148eac7bd1bbeef275024740f18f8e039b9a31b37b3301c6c1cff47046c441b166240f820a18ce7fc45adf01cb084529f4fb0b1ebc9489f34f29b43dfb117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c212b29df7af8b1bc7ebe315aec25384

SHA1
b749eb86745bbbbc720504a8c4dbd5bf0ed65692

SHA256
dd73c79bd6e41fc21fc930629fece854ec1c0dc279ee624f7861daa6bf8ae778

SHA512
cabda4de864b7aa523d07f297406d8efc398ee93e2b7a62e4586f35d81b42e76989ae5408abad144f43632c0742c137fbcc42ed866d3c39d3a150bf9284c201a

Download Submit