16663097a9ed3c1fb9b4be41319b150e742d98a81d3bcd6ed93da7d2cde2e6a4

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4313fcf44c334383a388afa3a5ea42cb_JaffaCakes118.html
Size

70KB
MD5

4313fcf44c334383a388afa3a5ea42cb
SHA1

6c8ff93b9be29418b2621d3674c4beeed3c8da54
SHA256

16663097a9ed3c1fb9b4be41319b150e742d98a81d3bcd6ed93da7d2cde2e6a4
SHA512

0889bc8be600c61a3145a4c500c0ee174fca6f430bfe31ba3281ee8e3515904ce8dfda9f99c0481a5519dea5e9158dc278dd409e46becee58f98664eede64b0f
SSDEEP

384:vKD0blfkuuuqElvZ/14URMNbAeI/VHWqb9yRV8uXa+sh9nVdgOY4C73Ig0K:75f/ZN4U6bAeaVHWW9yf8vNK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
1496	msedge.exe
1496	msedge.exe
4756	identity_helper.exe
4756	identity_helper.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 2760	1496	msedge.exe	85
PID 1496 wrote to memory of 2760	1496	msedge.exe	85
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 2496	1496	msedge.exe	86
PID 1496 wrote to memory of 4080	1496	msedge.exe	87
PID 1496 wrote to memory of 4080	1496	msedge.exe	87
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88
PID 1496 wrote to memory of 5072	1496	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4313fcf44c334383a388afa3a5ea42cb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fa8a46f8,0x7ff9fa8a4708,0x7ff9fa8a4718
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14544963794528438533,1310894822075310432,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,14544963794528438533,1310894822075310432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,14544963794528438533,1310894822075310432,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14544963794528438533,1310894822075310432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14544963794528438533,1310894822075310432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14544963794528438533,1310894822075310432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14544963794528438533,1310894822075310432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14544963794528438533,1310894822075310432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14544963794528438533,1310894822075310432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14544963794528438533,1310894822075310432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14544963794528438533,1310894822075310432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14544963794528438533,1310894822075310432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14544963794528438533,1310894822075310432,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5608 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5cdbb2c2bc70fd28b428c5741d2d6cdc

SHA1
8ab504eb0f9598cd04abc6d6c7198eae0e32cfb5

SHA256
bdfe11439dfae8b9f435d4326ae7414eda0f7b745462da99c00bd3b571c45e9b

SHA512
4c854e173a882e70f987cbe963ba1e5c556457f5e4362955c4872bb011d35d60bd66a7c0510adc1e47e7543df4455022baf72512fcf0b1c7915beeee686e45f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5136653b600cabcef7f76955560a3bb2

SHA1
46a084287f2859dd650fea8a6b62815abfb56df5

SHA256
e0df5cde7f5cc6e0a67342b86b99e186bffc7481d4216c063132b95b8fe09365

SHA512
392d0fdedc04cdb3041fac1b8670b637972b72eee26d403aea3e0ca68c30373f9b9332e2b8a5be4c2c1f965b2dc16fd8875cc1eac4dc6e28b21dd0eeea0b011f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
003206a9fedab9454cb8f24c019ffde3

SHA1
5be6fd15aa29b0060339f548a6bcc4b9c1bc751a

SHA256
ae067ac1a5fb49dcfa60318bec3a28d43e73abc619dd1a62b24d7157820474e8

SHA512
78be32a8c3b13deaa754c66de135c26ad9fdea56dcdeb406aa1afa0f3a9bf79c78a6c25c4273f49179759e659f7dd10cde8683a8ec37faff0abe05f9ffdfb087

Download Submit