4008a6cb3e3e2f8b5e3275136418d51ca90269e46de20e7eeb9cde5fb5b198c6

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4deab13a1334b230875a3cd615025021_JaffaCakes118.html
Size

53KB
MD5

4deab13a1334b230875a3cd615025021
SHA1

bc0a5cd98b1cfb13ed6af243f63e26dd23b7885d
SHA256

4008a6cb3e3e2f8b5e3275136418d51ca90269e46de20e7eeb9cde5fb5b198c6
SHA512

95a764ff7008105b3ac8c05f0c1abfc3d21f387aca73530843dd831d3039d047fd88483ac5694106dc2c00cbfacdbf17ac543ad7bc99c961c4cdc80f201be20a
SSDEEP

1536:CkgUiIakTqGivi+PyU8runlYS63Nj+q5Vy0R0w2AzTICbbGoP/t9M/dNwIUTDmDi:CkgUiIakTqGivi+PyU8runlYS63Nj+qv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
936	msedge.exe
936	msedge.exe
4360	msedge.exe
4360	msedge.exe
2176	identity_helper.exe
2176	identity_helper.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 1908	4360	msedge.exe	83
PID 4360 wrote to memory of 1908	4360	msedge.exe	83
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 1992	4360	msedge.exe	84
PID 4360 wrote to memory of 936	4360	msedge.exe	85
PID 4360 wrote to memory of 936	4360	msedge.exe	85
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86
PID 4360 wrote to memory of 1380	4360	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4deab13a1334b230875a3cd615025021_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c03c46f8,0x7ff9c03c4708,0x7ff9c03c4718
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,11818216818642901210,3096378040513902806,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,11818216818642901210,3096378040513902806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,11818216818642901210,3096378040513902806,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11818216818642901210,3096378040513902806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11818216818642901210,3096378040513902806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11818216818642901210,3096378040513902806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,11818216818642901210,3096378040513902806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,11818216818642901210,3096378040513902806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11818216818642901210,3096378040513902806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11818216818642901210,3096378040513902806,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11818216818642901210,3096378040513902806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11818216818642901210,3096378040513902806,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,11818216818642901210,3096378040513902806,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1384 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8dc45b70cbe29a357e2c376a0c2b751b

SHA1
25d623cea817f86b8427db53b82340410c1489b2

SHA256
511cfb6bedbad2530b5cc5538b6ec2184fc4f85947ba4c8166d0bb9f5fe2703a

SHA512
3ce0f52675feb16d6e62aae1c50767da178b93bdae28bacf6df3a2f72b8cc75b09c5092d9065e0872e5d09fd9ffe0c6931d6ae1943ddb1927b85d60659ef866e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1790c766c15938258a4f9b984cf68312

SHA1
15c9827d278d28b23a8ea0389d42fa87e404359f

SHA256
2e3978bb58c701f3c6b05de9349b7334a194591bec7bcf73f53527dc0991dc63

SHA512
2682d9c60c9d67608cf140b6ca4958d890bcbc3c8a8e95fcc639d2a11bb0ec348ca55ae99a5840e1f50e5c5bcf3e27c97fc877582d869d98cc4ea3448315aafb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
403B

MD5
51c8751948c8efdfeeb821f5d76afad4

SHA1
284d9aed7533f4c2f76450e2ccaef4f1ee95247a

SHA256
a3d6c3dae3ca9a1417b18ca9de831f042e9b963fffa3fc665090693c1c2df79d

SHA512
08572e1503a2a97b217ec3912181df08ee57231eb881a6a2836682888e126d0829182328299146c785b55239224f8b24e906f3fce6c13708e1ce6aa8cc9416ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
595d4c513cce01342ce679651b6589c5

SHA1
47be8adb4cde41d11842948f6dffd78a6254bbfb

SHA256
d78e4e1641987872e08ae814dbad17b80fa36eed44bbb75302cb95e1bb3a9234

SHA512
30a658ebcdc3846e3c02b5f6b7addb3ec4a60833e42fa64acd3ea381fa7cefbda9a6ad82c942ce7e0630903f86bf00041768428338a8a4b28076f96faa88c9dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f0def5412d59888bad087ee9fe73e62

SHA1
47946e758d80db8adb2e4dad96935e7e5bda4da8

SHA256
671bc6a849d8a9e1ee22f29fd706ec7778be3d22864d35e7cc4703b716c6f9fe

SHA512
548ac177402bd7337e48326e0423acf1b641d386c695f0240dc513b655225c37b364ed9aa5f09c64472367883608e536feef81cb1554e3aa45c7cfc9a7e0f9c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
babf3353ef9226d631b84ea71dc97f00

SHA1
15e61f9dbb4ce1d96edeff7ab72565da02a48306

SHA256
4b342c46daba3e50c25ba7a4f92945ea4b58c700fde279f720c5849b5a1db931

SHA512
747a6f158fb1a055c64fbf4b5cb8115617f48b042de1a355feb3cbcdf618c24babf5080ab06761c141a4987100be7709d2425329aea9a1864863ed67be90ed99

Download Submit