32ad2acdf0410ffc45981d3c142fe466657cfdab54227b2ff00ad00db90b0358

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 04:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4457bc3c30082eebdebe1d53ee72d0f6_JaffaCakes118.html
Size

93KB
MD5

4457bc3c30082eebdebe1d53ee72d0f6
SHA1

13785f9eb8ec1438b413ef0c9995250048deaec5
SHA256

32ad2acdf0410ffc45981d3c142fe466657cfdab54227b2ff00ad00db90b0358
SHA512

7ba1d11b2dd34af483559d840471a97bfcc8ffffd2ad0b3dd7e11d8ac72494a89cfcfd1fc91df5d396a67639d5c61b78648b7d3f40b3559f2369b7176fd9d68d
SSDEEP

1536:Ks2lwndGQkThnzkTaXuBwUz2gyMT77Jza5756btkPJXPzGvhKMTvcRz1vyhAOUsI:Ks2lwdYT5uvTSPs/TAYUSP6zY4VUWL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3876	msedge.exe
3876	msedge.exe
2496	msedge.exe
2496	msedge.exe
4888	identity_helper.exe
4888	identity_helper.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 1824	2496	msedge.exe	83
PID 2496 wrote to memory of 1824	2496	msedge.exe	83
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3036	2496	msedge.exe	84
PID 2496 wrote to memory of 3876	2496	msedge.exe	85
PID 2496 wrote to memory of 3876	2496	msedge.exe	85
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86
PID 2496 wrote to memory of 4640	2496	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4457bc3c30082eebdebe1d53ee72d0f6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb96346f8,0x7ffcb9634708,0x7ffcb9634718
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4981494545729267126,9802882302230374261,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,4981494545729267126,9802882302230374261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,4981494545729267126,9802882302230374261,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4981494545729267126,9802882302230374261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4981494545729267126,9802882302230374261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4981494545729267126,9802882302230374261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4981494545729267126,9802882302230374261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4981494545729267126,9802882302230374261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4981494545729267126,9802882302230374261,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4981494545729267126,9802882302230374261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4981494545729267126,9802882302230374261,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4981494545729267126,9802882302230374261,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
183B

MD5
b4ef59d57d3469c5fa53d709d330a325

SHA1
4d26ff838bf1ac65c2669bcfbd06ac06a336bf89

SHA256
90e062ed89751570e05ecd0a37a88098d14844711d192c89f319946ab7c0d3eb

SHA512
2d9c2e3720efe75287c04ae354253a17ee5bdcd3c1f8ca093119d2e526721b144a1ad0cddfc32bcc7867ed028cdbc53e119c2e87fb445b71ee4667d6b4b543f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a98c387b9c1bc09c7ad7edcd81350e5d

SHA1
edb4db67cbc5c4509e5029506fea7c405f274eff

SHA256
64070c42806f64405b2a986f9a1cde3d6235cad4fd77dfb56439b4894d808149

SHA512
1bd5c5a4978933974a269ede6cf169f36879b9c80855f85a9dedbfbedb923d1c2351e14f908cad1e3ea97e112e3fa200664b51f86a99f0fa72b5c0477d42d695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a13a97a6e178b71aad842962ee0491a

SHA1
538b69bd98d4977f914c2c87795e979a07b33bbc

SHA256
7e13934e738ed3c441b714dbe1279bfc64015e352c9c6162ac1816bffc517e8d

SHA512
adb06dc866b71a548b87aed86fddde1d6a6db152b1ed305842c0c775817f4e91d951fafadf5cc049eb289b9499f9dfae7ff89170b892211ccf0d0b6884497966

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2f2626b7b49dc85c0d86b8fb1ca0c5a6

SHA1
170f0060e1eba56000b60592861e8456e0fc67e4

SHA256
f691dc05568cfafdb4fc3cefdcd9b13a35bda3684b1982db6af20703ff1719e0

SHA512
5c6102cb64ed377272918b04d2933c0928e1dffa5485b01b90c246111b1288bcef19563ad8337b4683861173b772d894549881cf7c495702d84a8b9f689546c9

Download Submit