6244b4aca5eaa0cb271a2e9964a15ef6706c9abfc79cdadbf9c3df235e69152b

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c12528b497ea34a976198b04a8bf336_JaffaCakes118.html
Size

126KB
MD5

4c12528b497ea34a976198b04a8bf336
SHA1

1218c364dd6d47a28a23ee458779882a60fd67df
SHA256

6244b4aca5eaa0cb271a2e9964a15ef6706c9abfc79cdadbf9c3df235e69152b
SHA512

089e266649a5ff5787ef23184476ded886ff9c4d5bfd4e3bbe861355766bc021d4fbaa99f5aef958cf0dbdee597a582cb616962dd1044f6229db53c0447ed9be
SSDEEP

1536:qS18yuryLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9w:qS18yuryfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
64	msedge.exe
64	msedge.exe
3568	identity_helper.exe
3568	identity_helper.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 2108	64	msedge.exe	83
PID 64 wrote to memory of 2108	64	msedge.exe	83
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 3680	64	msedge.exe	85
PID 64 wrote to memory of 2352	64	msedge.exe	86
PID 64 wrote to memory of 2352	64	msedge.exe	86
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87
PID 64 wrote to memory of 4848	64	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4c12528b497ea34a976198b04a8bf336_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee71546f8,0x7ffee7154708,0x7ffee7154718
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,3685410567172730558,1013976242808994694,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,3685410567172730558,1013976242808994694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,3685410567172730558,1013976242808994694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3685410567172730558,1013976242808994694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3685410567172730558,1013976242808994694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,3685410567172730558,1013976242808994694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,3685410567172730558,1013976242808994694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3685410567172730558,1013976242808994694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3685410567172730558,1013976242808994694,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3685410567172730558,1013976242808994694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3685410567172730558,1013976242808994694,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,3685410567172730558,1013976242808994694,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5108 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8dc45b70cbe29a357e2c376a0c2b751b

SHA1
25d623cea817f86b8427db53b82340410c1489b2

SHA256
511cfb6bedbad2530b5cc5538b6ec2184fc4f85947ba4c8166d0bb9f5fe2703a

SHA512
3ce0f52675feb16d6e62aae1c50767da178b93bdae28bacf6df3a2f72b8cc75b09c5092d9065e0872e5d09fd9ffe0c6931d6ae1943ddb1927b85d60659ef866e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1790c766c15938258a4f9b984cf68312

SHA1
15c9827d278d28b23a8ea0389d42fa87e404359f

SHA256
2e3978bb58c701f3c6b05de9349b7334a194591bec7bcf73f53527dc0991dc63

SHA512
2682d9c60c9d67608cf140b6ca4958d890bcbc3c8a8e95fcc639d2a11bb0ec348ca55ae99a5840e1f50e5c5bcf3e27c97fc877582d869d98cc4ea3448315aafb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29dceae7a10893a58dcb6f2304e87a15

SHA1
bbf2eb62aac4565d1b6c42ddd2accb9b43b60a85

SHA256
5b79b552d77d9b19c3bd1bc27b5ee08a5ad27b1e8151b1836622453b407e3f9b

SHA512
e9d3a71f4346f798aae87eaf2ad69342a5c5d75309d653cadb4c56c1c57335b7dcaf36f6e24b2953dc9dfbfcda1941d63f150e589a51fc3aac47e14163366f07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c76f0c65775af11f71467056f6c13bc

SHA1
78c66b647f1f482ae671fe30ae9d87b71b5ce2e3

SHA256
6ae14630059b623b1ead76670c4a04d53131c061a0fcdeec523f544581669e74

SHA512
e93c7a0daeb7a69f02b399586a2e69346b23e8fce09dbad800ee6d8e222bf17853cfbd52d4f6ce0c19216a657f14b6aac6a4a11f61bf54b934c858d348e7b228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
06d59a6403febf7bb29d391d47cec329

SHA1
b22e11a4d315bc48f13c84059c5e4378e4523b8e

SHA256
49cb2719de479e2fc65d26678de81528f05505b68c8649ee8578e7777813a115

SHA512
0461f5c84187937fe136b01960954360a8adacbd5a0ad7984aeb153223c3bd506fbc00f8ca990ac4c207c73c4e4cb2ab48ecbe5ffd5bb07b1e5fb5966ea25471

Download Submit