2af67c6a715cd092c09d2422779bb644ef5dc9e254b9a8ca491dd67032bb779b

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47b199702b0dd2c51cca8d9085f125d6_JaffaCakes118.html
Size

73KB
MD5

47b199702b0dd2c51cca8d9085f125d6
SHA1

1a75397bdcf4165317e68c171a6a93f623fd4c6a
SHA256

2af67c6a715cd092c09d2422779bb644ef5dc9e254b9a8ca491dd67032bb779b
SHA512

125b8f73480d2e118256ccb0ebaa8e6849a6005b9163e23a8993ccfeac7253cd35fd5a76cce09b6948ab9560d3d76a96cc956dcfa79bd1a2fd7f49ec31269d23
SSDEEP

1536:fCC+yfE+WP8Zvn3BQldj21NMcs7OZw9JBXBGKtVS8JhksfgNyp32Rx/o0altCtRj:G8bbR/3J

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1000	msedge.exe
1000	msedge.exe
3216	msedge.exe
3216	msedge.exe
4108	identity_helper.exe
4108	identity_helper.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 680	3216	msedge.exe	83
PID 3216 wrote to memory of 680	3216	msedge.exe	83
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1744	3216	msedge.exe	84
PID 3216 wrote to memory of 1000	3216	msedge.exe	85
PID 3216 wrote to memory of 1000	3216	msedge.exe	85
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86
PID 3216 wrote to memory of 1036	3216	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\47b199702b0dd2c51cca8d9085f125d6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ff9d53d46f8,0x7ff9d53d4708,0x7ff9d53d4718
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,6870995510892084658,955994869843380231,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,6870995510892084658,955994869843380231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,6870995510892084658,955994869843380231,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6870995510892084658,955994869843380231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6870995510892084658,955994869843380231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6870995510892084658,955994869843380231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,6870995510892084658,955994869843380231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,6870995510892084658,955994869843380231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6870995510892084658,955994869843380231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6870995510892084658,955994869843380231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6870995510892084658,955994869843380231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6870995510892084658,955994869843380231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,6870995510892084658,955994869843380231,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
980B

MD5
702e3d27975f425a1143f8ab785a51e3

SHA1
18379d559b73c1e980ff2abb0f52711a338277d1

SHA256
ae1e716bdcfe699afb969d0a745722116beeb83d873d18cf689eca579daad69a

SHA512
99ae64c69a7dafc477c20f24794e374279dff1eb4dad21c0111140493c7ef506b998b10a39af01a7da185c1396f8d3efcc3fcbfde92f970709a5ae57e8bfc77f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
483d23ae21f7d20f0124ff9a418547e0

SHA1
5e7c6957fe76525e24c5feb1230b0f044a31460f

SHA256
9712482a0c336e8e1d1caf04696a07befe8a46e070fec31c58e5310c4cff12c2

SHA512
e6dc19f5e6c4d184dca4a34b3df96dd124cce5283e0970d32f3d70efa7170504f51a083839c756a6f97b5d3b71162228a471b3ae0032d7695da2e6a1323ffa99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d57ea26f02e8ccf63377431d28b91c9f

SHA1
dbc7392848e1c9661d5d02e57751299e98c6be5b

SHA256
81c76cd74b48c47453eed0543bbdae6dc045575cc6dd6e82b4dae66b6dfb6faf

SHA512
fd73d43896b17cc3841cee059e584b4f62d78054b713595424db6bffd42d0692715a6c21cb45e030353976b3d3a168cea9eb8d3cda6af8acfdad299f5a099a71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
79e6425317d0af5613c16d6bd269c5b2

SHA1
453913f20c6a1916e1e7986e352119e55b9df532

SHA256
ab8d7bb6cd6f2af844f5eb40f71bbee1aece518e93a2ce4464ba65858a15862c

SHA512
b18bde2649ffdbdd7e4e8457a21bc035352b709b3262cc2ab36003b974d8b29f52499701f9b804007700dbfb9f80d996d634a3ced66cecfbceb7e692e9bb306c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
be9534d30d65cdc7298ce51232664a87

SHA1
71b3fdd50dd0b88f7f21bcf149482532794c3113

SHA256
da6c10b3dfd89a69bcc4be64d7b29460095ef2d919ad6bc007a5f8a37bee176f

SHA512
e69f95bc846a0f0ec10cc56bfe6ab6bba6d694b0e66b85c08058f3558899cef93b47c520116daf763a5f2e749183d16b897c7dc0053914d43ca984862a9a2dda

Download Submit