ea1cb49f1347230b0ed59a93040035de915567e61fcd31f2f186d5055e6982a5

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 06:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ae0e7de9e1026cc730ca43c41c3a18f_JaffaCakes118.html
Size

103KB
MD5

5ae0e7de9e1026cc730ca43c41c3a18f
SHA1

9a1ab6f8edd2aef9004adc36a8708f5ee650bb1a
SHA256

ea1cb49f1347230b0ed59a93040035de915567e61fcd31f2f186d5055e6982a5
SHA512

bee1de7ce56d73702c9473bc104108f1d04753d9b3075d3ede01755a23f5b3137ff0dfbf9df8c1134d8a78ab2bb6f2ed5fd0a71c65ad9a0c3be8a56edd2a4389
SSDEEP

768:sBpPPLKoPlF/eDYPbx7HG4a/m9SxeH9Ww09LVMrAvl3vNNHOolaywHBIbW57TqLH:54kYEdL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
2492	msedge.exe
2492	msedge.exe
3420	identity_helper.exe
3420	identity_helper.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 3792	2492	msedge.exe	86
PID 2492 wrote to memory of 3792	2492	msedge.exe	86
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 3392	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	88
PID 2492 wrote to memory of 4408	2492	msedge.exe	88
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89
PID 2492 wrote to memory of 4540	2492	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5ae0e7de9e1026cc730ca43c41c3a18f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd779d46f8,0x7ffd779d4708,0x7ffd779d4718
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9806027624767722782,9680714197296245430,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9806027624767722782,9680714197296245430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,9806027624767722782,9680714197296245430,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9806027624767722782,9680714197296245430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9806027624767722782,9680714197296245430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9806027624767722782,9680714197296245430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9806027624767722782,9680714197296245430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9806027624767722782,9680714197296245430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9806027624767722782,9680714197296245430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9806027624767722782,9680714197296245430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9806027624767722782,9680714197296245430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9806027624767722782,9680714197296245430,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8dc45b70cbe29a357e2c376a0c2b751b

SHA1
25d623cea817f86b8427db53b82340410c1489b2

SHA256
511cfb6bedbad2530b5cc5538b6ec2184fc4f85947ba4c8166d0bb9f5fe2703a

SHA512
3ce0f52675feb16d6e62aae1c50767da178b93bdae28bacf6df3a2f72b8cc75b09c5092d9065e0872e5d09fd9ffe0c6931d6ae1943ddb1927b85d60659ef866e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1790c766c15938258a4f9b984cf68312

SHA1
15c9827d278d28b23a8ea0389d42fa87e404359f

SHA256
2e3978bb58c701f3c6b05de9349b7334a194591bec7bcf73f53527dc0991dc63

SHA512
2682d9c60c9d67608cf140b6ca4958d890bcbc3c8a8e95fcc639d2a11bb0ec348ca55ae99a5840e1f50e5c5bcf3e27c97fc877582d869d98cc4ea3448315aafb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3820ee0239ac80d77660294bddd95b4f

SHA1
f513782e5c493e4baac4f45287dd5ef2e02ab015

SHA256
42e4fbd8a789821d97fe55d374c54a33f63382a062359789c965beddfd43f4d0

SHA512
6a0894901a4684fa8f55915ab1b0c18058e807e051e369905b6bd4f1c33478a98fea9afcc5f2dc5c78200d06070a1e29cc7c9f12245afeeb4b70f9a2df532418

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9379ccbef23993a2f010c9caa310e1c5

SHA1
a10094655177e3484303c88bbabd0f8f322ad52d

SHA256
08c29d53965209b49345868be599ffcafe9b284ef7e4a0bffbdb6f2f45445e0e

SHA512
708646534567600dd7ffc8c0a9550d8093b152063ab295274694beb4ab43bac58c0e909262fa9b8437c571ae210772b380d0eeaa1fa069d7c91270180973f867

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
41c55e4695c5482b6409f8a4a6a9c727

SHA1
e27723d04cca9e2318397e3bf5058bc52ab19e62

SHA256
6b8f1b6b545410bbb305f2ba27feb1355c2d2ad63ae939b8e5f6ba4e3c15e52f

SHA512
b46676f3f8425f46bd0bd96f7deea187f84a7ec0a676898650a2558c1cd0acf8178aa367ca64d835fc7b743de26a156d82d34c5355bb3bbbd99f4d74be669267

Download Submit