4361c34da5268a576743fe9af405beb4c632d1b53553c68987104d7f749e644d

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63d0e7a84312d929dfc27f63fb1dc41e_JaffaCakes118.html
Size

142KB
MD5

63d0e7a84312d929dfc27f63fb1dc41e
SHA1

73751537a665c86094a5bedd752cdb970de668f5
SHA256

4361c34da5268a576743fe9af405beb4c632d1b53553c68987104d7f749e644d
SHA512

88a149c2807ef3c7a71ec42a2a8fe82305a0e1d762973fcc0868e0778ce850ffd7e457f99794c677e104afdd45e2fc55a402a17cd4ba0eb5bc6b443264698a3c
SSDEEP

3072:WVGejtPUeUwIVGejtPUeUwQM+1xQtL72DAMHzlTpPvA0ZLpbq8gmLtNiqJhkZG:WVGejtPUeUwIVGejtPUeUwQ1SL72DAM/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
1744	msedge.exe
1744	msedge.exe
2448	identity_helper.exe
2448	identity_helper.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 5004	1744	msedge.exe	84
PID 1744 wrote to memory of 5004	1744	msedge.exe	84
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 212	1744	msedge.exe	85
PID 1744 wrote to memory of 784	1744	msedge.exe	86
PID 1744 wrote to memory of 784	1744	msedge.exe	86
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87
PID 1744 wrote to memory of 836	1744	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63d0e7a84312d929dfc27f63fb1dc41e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff93ab46f8,0x7fff93ab4708,0x7fff93ab4718
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6791076697200971204,14023260360559619842,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,6791076697200971204,14023260360559619842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,6791076697200971204,14023260360559619842,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6791076697200971204,14023260360559619842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6791076697200971204,14023260360559619842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6791076697200971204,14023260360559619842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6791076697200971204,14023260360559619842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,6791076697200971204,14023260360559619842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,6791076697200971204,14023260360559619842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6791076697200971204,14023260360559619842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6791076697200971204,14023260360559619842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6791076697200971204,14023260360559619842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6791076697200971204,14023260360559619842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6791076697200971204,14023260360559619842,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4684 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
595B

MD5
97ea895728b86eb998719c1dca762bf5

SHA1
8f0c1c430ae26eedf57d41e505a8cacec5e572ff

SHA256
60894befc70694778f1ecf156cb57ad1899b040277eb6d295fb10727dcb330a9

SHA512
601feb35bbd372b197ceb84e06aa4969660fd9f8a6406f8be10ecad2e5858cded8f95e93fdf6f70d495486f3e2e5f30a53a450fa4cb0aca0cded31b1bf0ca684

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c4d79bb38af6ebbc6c6443fe0d5c82f9

SHA1
ac4681e11774e8eb4392685c2f0ae4143517b244

SHA256
ffcdfb7714d2f909a44dd35ac4768b72b7e86ad29cd79a90314885e8b4dcda68

SHA512
9293249b5c1abf7e3652d0ad585a35fff71a26531431b62532c4ecea24f9cc675c39973ec1912877ec9fdb0eba15bc3569f3209d57a65f703426af9583acdab5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ab02171e2f74a12e4c74e5fa05f7ebe

SHA1
07e6e39e46377396d53ac1c8f43b8e2edd15dd7b

SHA256
b33bb1e291b87f3abc3816e8490c2c6c3604860c78ae82cc6686d9b4acef63cb

SHA512
cd33a7e42a5c863249e9d689adcf4d0b4086637cb557ae9141e76ab1753168cf90c50ab5a1b44f049d059eb06a86babc0364778ca3c5e9cfab66392c261c38f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ba923082acf4745521ae330daef1df2

SHA1
ccaab096a39b23097b2f7b3b872700d47f08b6b5

SHA256
b14abcf09d000933e0be0763338c5c157ad3bf4472c348ce1d5bb91396adc766

SHA512
37a31650b50e613f2052ef6cf04d29f0ec34c6689e6ea14cc3d45e1755363f9ee8899e8c3d4338334f4aac7db1a0ac86dc885ee1b0bf9342db97c732ec999f98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
93c32f0e1dcda7a5d7fc90937c14c896

SHA1
8351e6f175d49e6b961367b453cbf0c561c98f12

SHA256
efb0fe4e66e22b064bc4bd5d1bde1b2808e2a6cc36da44767c147091c5d9b5bb

SHA512
3a9f9a0f372bb43b11461c11d809f6910d76fce5655fbb4ddb83e31368d1f97a156f3bf30d1314b93668dd17c109dff9ebbe06547afdbc80211e0597dd4db3de

Download Submit