b57cc45b0a2f176d07879e6ec51c6c6dd73fc6dd53f1e1e41d78528e19703325

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

482cfde4782cf8bd379dbd5e3f5625d8_JaffaCakes118.html
Size

11KB
MD5

482cfde4782cf8bd379dbd5e3f5625d8
SHA1

913aff573599f3237e4d6dfbd6ce5c07ff2d905c
SHA256

b57cc45b0a2f176d07879e6ec51c6c6dd73fc6dd53f1e1e41d78528e19703325
SHA512

d1c7b240ec71d96235b1705f77ced1e413b48d73c5fb074111f237fcfda1df81f2f7826c10348de406956933971b42fb4ecad397706c7efa853623027c3f039a
SSDEEP

192:SIDU8FTpF9FENTV6yKqMjI3EwuyQzUbrJy6hEcZG4C1Yje76RTZRQ:SIfLrENEPwuyQzerM6hE1+eu2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
1052	msedge.exe
1052	msedge.exe
4896	identity_helper.exe
4896	identity_helper.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 4264	1052	msedge.exe	83
PID 1052 wrote to memory of 4264	1052	msedge.exe	83
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2320	1052	msedge.exe	84
PID 1052 wrote to memory of 2768	1052	msedge.exe	85
PID 1052 wrote to memory of 2768	1052	msedge.exe	85
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86
PID 1052 wrote to memory of 2964	1052	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\482cfde4782cf8bd379dbd5e3f5625d8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff158a46f8,0x7fff158a4708,0x7fff158a4718
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,10397103801540179713,15201150518691465060,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,10397103801540179713,15201150518691465060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,10397103801540179713,15201150518691465060,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10397103801540179713,15201150518691465060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10397103801540179713,15201150518691465060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10397103801540179713,15201150518691465060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,10397103801540179713,15201150518691465060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,10397103801540179713,15201150518691465060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10397103801540179713,15201150518691465060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10397103801540179713,15201150518691465060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10397103801540179713,15201150518691465060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10397103801540179713,15201150518691465060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,10397103801540179713,15201150518691465060,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4648 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3960e31aa9cef06afeeb8f5bc6755313

SHA1
d1ce9371d5bcf5461bf723c2ebbab86a9007dda4

SHA256
9feb622b91fa722c1e120df01e83fdafe8e13458d37ec767ff0504d145ed235e

SHA512
63cb98feafd2958edd661296252e4aa3a11ad3f501459006b43f93ca9272b2e6c75880db25702d91c34e88110186c19499751879167042b288b831c239980950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
49c79d0172d4a65a7e64c9a8562f8e62

SHA1
998f0a5b334cf46727b9a2de951271a906a456ff

SHA256
5373b5d57a117c634b327d731d09b77c59f88ed66eed66093911f2b2fcd78418

SHA512
384c0f8c3012dbf1d67d13134732a8b076888cac5ecaabfbf6224214a55b491aa0c5c94852e2ab2e878bd020bc677f4dc3b67914ab0a2361cf2c80f41d8d5903

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
75c6c006c31de01c3822b5c397a549cc

SHA1
d72494f3e5bd6f956504d3629e0d42f74d9142fa

SHA256
c3158b879a5a64c063d6decef705e638d4cdce13676f013c7e556927f2a5532a

SHA512
941092282eb3f889fdbe1aa0dd2e5fab4656ff9598c5f26794b2dd5f471adb046f6ca7a3ba2ad88c17ae7db8327d617eff32ecdf937ed67267f7b7db7b9cbb51

Download Submit