9be94fd81fdc8d1d29f28aa98d8a0a242412eba1c0713f6f64ff46371eab00eb

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ea5aa88e1635f72d9e18bb2e552f93e_JaffaCakes118.html
Size

10KB
MD5

5ea5aa88e1635f72d9e18bb2e552f93e
SHA1

b63183df23a209bd879f116c15d397bcba128240
SHA256

9be94fd81fdc8d1d29f28aa98d8a0a242412eba1c0713f6f64ff46371eab00eb
SHA512

14e9696239e85335c0d3d4c9a6b5309ee49316dae804009e49b293059a9994dedcdc5a759bb1952e90bf8ab8c1d5c035b06659a2ca7df4e097751e207b5ce032
SSDEEP

192:SIjlctn9phIwH/3xVyhxI4UFpMKVUNOnVl4NmsmjX1ln22fBCgl6PcAmT8:SIwn9phIiSuMXNOVljsaldNfBbic1T8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
4320	msedge.exe
4320	msedge.exe
5060	identity_helper.exe
5060	identity_helper.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 736	4320	msedge.exe	84
PID 4320 wrote to memory of 736	4320	msedge.exe	84
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2772	4320	msedge.exe	85
PID 4320 wrote to memory of 2052	4320	msedge.exe	86
PID 4320 wrote to memory of 2052	4320	msedge.exe	86
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87
PID 4320 wrote to memory of 3264	4320	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5ea5aa88e1635f72d9e18bb2e552f93e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1d8946f8,0x7ffc1d894708,0x7ffc1d894718
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,11641175295796804478,14657242423691240686,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,11641175295796804478,14657242423691240686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,11641175295796804478,14657242423691240686,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11641175295796804478,14657242423691240686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11641175295796804478,14657242423691240686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,11641175295796804478,14657242423691240686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,11641175295796804478,14657242423691240686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11641175295796804478,14657242423691240686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11641175295796804478,14657242423691240686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11641175295796804478,14657242423691240686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11641175295796804478,14657242423691240686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,11641175295796804478,14657242423691240686,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6c86c838cf1dc704d2be375f04e1e6c6

SHA1
ad2911a13a3addc86cc46d4329b2b1621cbe7e35

SHA256
dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb

SHA512
a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27f3335bf37563e4537db3624ee378da

SHA1
57543abc3d97c2a2b251b446820894f4b0111aeb

SHA256
494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a

SHA512
2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
46c0ce027a0a915982d2919a12b90185

SHA1
b0517dfe359f1ac81e01c311de06a8f75f36d6e6

SHA256
ae16f09e3e38f93772774bd306e9cc582fe87ca73fe30f41c9315dfbe950cbd3

SHA512
2e0e232983d1ebf2320b8daa7f15fefb5df02041fb52a13611ce9610564c912c135900ca5cce5ddc3c39883b71faa3145f5d967b22eb7f44c51dfc030e95babc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
990ff76d5b2b834058f136c5f6fcd0af

SHA1
df23e0d3ccafa99467c4e7e088f4dfffc115c8f3

SHA256
1aec1307df9082907385cad7bd1dfb46f64d31afec1da760ebfaebfc81f3a9a3

SHA512
48f7682bbc23661bb590761d4122251f8d308b2ad32e3f679529f1a37f9b807fa92ff5d6093177df7d21dca8f1945b3d3de96000e2e547ce9e63ae771bf8c3df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f93875b8918c35b43429235384e384d1

SHA1
df8232787f34c65580e7756cdbd8e5cafc925f51

SHA256
2f5e49a6de932cbfd41643c6773087257bd85002cd2aa950c7149a7d4755f838

SHA512
011cdb114b091c874ce72148869d69ba2cdedc2cc0404449388dae8de69b3e8957ad2ad273f281be12ebb1ced2439c9fb662961162e7efbd19fd6c339fb2a9d3

Download Submit