1d024810e6bbd56d8011cc9c1afb9fb2b1febdae8bd13421cd7bd18b6c3e7dc6

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4dfaf771efbb763e4aae6aff5f8a219c_JaffaCakes118.html
Size

53KB
MD5

4dfaf771efbb763e4aae6aff5f8a219c
SHA1

6f6d99f7b6b929bd4bc12afc987d02ad4050dbe4
SHA256

1d024810e6bbd56d8011cc9c1afb9fb2b1febdae8bd13421cd7bd18b6c3e7dc6
SHA512

01db279c5acb555734c0c6ca858464a9fa3ac72e28230cf98cb284a4ff154ddf28a72bc538577dd7a0e6d1e493ac09f62a95b775645f27436600782cdb44fcbb
SSDEEP

1536:CkgUiIakTqGivi+PyUgrunlYG63Nj+q5Vy0R0w2AzTICbbToH/t9M/dNwIUTDmDo:CkgUiIakTqGivi+PyUgrunlYG63Nj+q6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
1664	msedge.exe
1664	msedge.exe
404	identity_helper.exe
404	identity_helper.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2452	1664	msedge.exe	83
PID 1664 wrote to memory of 2452	1664	msedge.exe	83
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 1368	1664	msedge.exe	85
PID 1664 wrote to memory of 2140	1664	msedge.exe	86
PID 1664 wrote to memory of 2140	1664	msedge.exe	86
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87
PID 1664 wrote to memory of 632	1664	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4dfaf771efbb763e4aae6aff5f8a219c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc51046f8,0x7ffbc5104708,0x7ffbc5104718
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,7752437058205081922,9280367864302159189,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,7752437058205081922,9280367864302159189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,7752437058205081922,9280367864302159189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7752437058205081922,9280367864302159189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7752437058205081922,9280367864302159189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7752437058205081922,9280367864302159189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,7752437058205081922,9280367864302159189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,7752437058205081922,9280367864302159189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7752437058205081922,9280367864302159189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7752437058205081922,9280367864302159189,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7752437058205081922,9280367864302159189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7752437058205081922,9280367864302159189,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,7752437058205081922,9280367864302159189,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1f9d180c0bcf71b48e7bc8302f85c28f

SHA1
ade94a8e51c446383dc0a45edf5aad5fa20edf3c

SHA256
a17d56c41d524453a78e3f06e0d0b0081e79d090a4b75d0b693ddbc39f6f7fdc

SHA512
282863df0e51288049587886ed37ad1cf5b6bfeed86454ea3b9f2bb7f0a1c591f3540c62712ebfcd6f1095e1977446dd5b13b904bb52b6d5c910a1efc208c785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
60ead4145eb78b972baf6c6270ae6d72

SHA1
e71f4507bea5b518d9ee9fb2d523c5a11adea842

SHA256
b9e99e7387a915275e8fe4ac0b0c0cd330b4632814d5c9c446beb2755f1309a7

SHA512
8cdbafd2783048f5f54f22e13f6ef890936d5b986b0bb3fa86d2420a5bfecf7bedc56f46e6d5f126eae79f492315843c134c441084b912296e269f384a73ccde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
403B

MD5
2e0c5f12d51cd5fe52548bd1888a41fb

SHA1
793bc315679ef5b292b989ee8d466ca56f35c0b7

SHA256
2ebe134a089318b5f0bb9db066f01e1581f88e4a85753f2f552aaedcaa72372a

SHA512
78173e9f3485a1966df3a1cf6c54e13277d14d338f254cb3931cc35874d273b86ba2476748f43415408d9d3f29c21623c941c4f0ff5582a7d337690f615d9c41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
676cef75c23161d223c8fecbbe7b6bbb

SHA1
7fac2f4a845e9c78c5a708634898f0a28db62f91

SHA256
36eb14ab544836362c74ef639b08c20f1d261b446231ebf47477d3936aebd1cb

SHA512
0c63da7612c1cd7cac27a99129789575f32ffe4fa5528014efaed51772f6118638f8255bfa287c17600244c71155bd159fc77207255ffbad0e10c3d2b5c32598

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
abea74d9126ad3f6d9af8e49a51292e7

SHA1
552df2f891a43cbe6466c12baf475e8727c5c8ff

SHA256
db607a5d69c29d0133cdf4e49c6f1dc98a816b6fdac614e3f264d6615c03b51e

SHA512
0bae7ce0bb6cf1b1b4763d290e1505dbeb5c552c9d5ff4c3d5434060711fa843b13c0d71af3e040dcc5ad1ac19b17e7377dd675180c18df5eef08be6f319cca5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aed0e92a936badae060834f692c106e3

SHA1
7a8a8446c4db8462dc9d55daea7b4b0164c907aa

SHA256
e33d09e07d7b5cb67fd510569d207bf72be3f3f4f00e209aba683466239c7e76

SHA512
6fc3effde56a3a13a96a697f1763881c5179acec64e77b022ff257a5770182c55ad506f2d6d6128cad69f2c3825aece143722994971f1808148dc82b05a5d8b9

Download Submit