935721bcd04fbbad5d430f0b7076e2555ba447763c04140d547add766af76f4e

Analysis

max time kernel
148s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

488fa60277672931b035b5ea6a4d982a_JaffaCakes118.html
Size

6KB
MD5

488fa60277672931b035b5ea6a4d982a
SHA1

df0ff27de41915e3e65f8445c254a4a3efc9d0c0
SHA256

935721bcd04fbbad5d430f0b7076e2555ba447763c04140d547add766af76f4e
SHA512

3cb346e1e8e648c040d7d577ffd70f56dc75d18bdb72fc0ba9f93f45bb83f937c51facc0d3783fccec5bbbd4432be640c99b1a99db8e1da47f589ab7a5501d12
SSDEEP

96:uzVs+ux7wGLLY1k9o84d12ef7CSTUTX/6/NcEZ7ru7f:csz7wGAYS/c4Nb76f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
4212	msedge.exe
4212	msedge.exe
2692	identity_helper.exe
2692	identity_helper.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 4644	4212	msedge.exe	83
PID 4212 wrote to memory of 4644	4212	msedge.exe	83
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 3092	4212	msedge.exe	84
PID 4212 wrote to memory of 2968	4212	msedge.exe	85
PID 4212 wrote to memory of 2968	4212	msedge.exe	85
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86
PID 4212 wrote to memory of 3916	4212	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\488fa60277672931b035b5ea6a4d982a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc279146f8,0x7ffc27914708,0x7ffc27914718
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4719739334933075177,9392667437944941057,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4719739334933075177,9392667437944941057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4719739334933075177,9392667437944941057,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4719739334933075177,9392667437944941057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4719739334933075177,9392667437944941057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4719739334933075177,9392667437944941057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4719739334933075177,9392667437944941057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4719739334933075177,9392667437944941057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4719739334933075177,9392667437944941057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4719739334933075177,9392667437944941057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4719739334933075177,9392667437944941057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4719739334933075177,9392667437944941057,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5620 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5714626b-afa6-46fc-b5d8-e7a36c658faa.tmp

Filesize
11KB

MD5
3b31349f6bf15a13259f7186a83e4bb3

SHA1
742e930ef0fb21a204d5ee5c4d945fa81b76296f

SHA256
a1d8e6965c3f25d804ddae0b118a6099ce48f9366a4ecef57a24f0566f6f1523

SHA512
281af52ba73c20909cf87ecd022c8167d8a05fccbc763caf69a6541a7c6c1ee6f6beb2ba8a26f8cbdab2e3850433b02f03adf0c04f68ff0851216195928c625c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
210676dde5c0bd984dc057e2333e1075

SHA1
2d2f8c14ee48a2580f852db7ac605f81b5b1399a

SHA256
2a89d71b4ddd34734b16d91ebd8ea68b760f321baccdd4963f91b8d3507a3fb5

SHA512
aeb81804cac5b17a5d1e55327f62df7645e9bbbfa8cad1401e7382628341a939b7aedc749b2412c06174a9e3fcdd5248d6df9b5d3f56c53232d17e59277ab017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4e6521c03f1bc16d91d99c059cc5424

SHA1
043665051c486192a6eefe6d0632cf34ae8e89ad

SHA256
7759c346539367b2f80e78abca170f09731caa169e3462f11eda84c3f1ca63d1

SHA512
0bb4f628da6d715910161439685052409be54435e192cb4105191472bb14a33724592df24686d1655e9ba9572bd3dff8f46e211c0310e16bfe2ac949c49fbc5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ea170d4862c311660d90b3f038fbe22

SHA1
7e827d9adb23a7e2c806056f57bf1c012751c658

SHA256
f947650401d6e7fbc5b4dc769e442339b362a50c825702c79dea5c4cc07ffac4

SHA512
4bc1401069672f648b64f48f788efe6393964bfc965cb770db9d358393b20aa8d809e80bf71f21634cc757d0b546bebf2027e4770ecc1461cb961c1d669ede1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
277fe588a40495aeb6d3fd834eb642e9

SHA1
ffe0515b8efd543f6d03a739d0a91700d35abd3b

SHA256
8b2ba1aad8f302f7c8c5a3fe3eaa3896a5dc7228bbd79b1dacc561b61fc09428

SHA512
4b9ab7349e0623c1ae1f3b834eb0e0cdaa8d8f6926cbb33366569636bd51955efbc929d5a9f4e24103bacf45431d42a3a19153c6cfc384b3b6713785904ce6e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit