940d6821596c36b7dff0ad9ff39d5c83d373e3f78dd9d6c7f3a3c984f47cfc78

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63ddb82974824a7d1ad908bcdf67793b_JaffaCakes118.html
Size

67KB
MD5

63ddb82974824a7d1ad908bcdf67793b
SHA1

4ba16b534ca4bb2d8cf87ce83d268c46f29e41dd
SHA256

940d6821596c36b7dff0ad9ff39d5c83d373e3f78dd9d6c7f3a3c984f47cfc78
SHA512

9259ff66cc686529de02d33a0c94d81b1e20909cbb90895fa167b477be373fe1433a34df335a273ca9d84b4d9aae3ec8a52d011142994389790ae9a74ad96dad
SSDEEP

768:z/ukWsxsGRJ7+WAv6xkOaqtKCosybtvFxV2rpVHO6uK6:z/jxsGR9BaqtKFTxcpc6uK6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
2380	msedge.exe
2380	msedge.exe
4328	identity_helper.exe
4328	identity_helper.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 3444	2380	msedge.exe	84
PID 2380 wrote to memory of 3444	2380	msedge.exe	84
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3632	2380	msedge.exe	85
PID 2380 wrote to memory of 3476	2380	msedge.exe	86
PID 2380 wrote to memory of 3476	2380	msedge.exe	86
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87
PID 2380 wrote to memory of 4072	2380	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63ddb82974824a7d1ad908bcdf67793b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93aa346f8,0x7ff93aa34708,0x7ff93aa34718
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13867353583219610445,1008907714846127579,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,13867353583219610445,1008907714846127579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,13867353583219610445,1008907714846127579,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13867353583219610445,1008907714846127579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13867353583219610445,1008907714846127579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13867353583219610445,1008907714846127579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13867353583219610445,1008907714846127579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13867353583219610445,1008907714846127579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13867353583219610445,1008907714846127579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13867353583219610445,1008907714846127579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13867353583219610445,1008907714846127579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13867353583219610445,1008907714846127579,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
192B

MD5
510275f308d2dd09222aa8b132f738bc

SHA1
47898b85246fad33ae7eaa4a74e500c15ee12165

SHA256
b29366b4de42915a1b1129b836c9769363d06a10436050a37faf0341abbb3b88

SHA512
9f1aaef832f32014e8df459d9a43323d53b290f40141420503b986e4917ca670679ec8eec0aeee77bb72922cd5b5fca2939070c3e1116b18743c0d8f24917e1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
72113fe0d1d4a598793b0203164a2bac

SHA1
4b98d83a106049ea664c92e518729aecddcd0ace

SHA256
89924f305cce010456d40bc1b5b7f4078f98ae238a663145d3c533047acbe257

SHA512
0c9de1d51013d9c0cc68501d003418cfaa08cd97fa2cc59c104de362c1b7e547f1ad6540d9b425aeaf4cb8380b9257df5016a3b4dc2f4e2914c80040c0b84623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a43395ec-f999-4046-a12b-60755cb63be6.tmp

Filesize
6KB

MD5
41450e588d435b77d1f6b9e3ddfe647a

SHA1
e1d454e006450756d4646f2b54937ab1ed5c7f09

SHA256
6a370798f8943967ab88ecbc0b38264167085f89f98f6bcfdf89c99e5d70cc46

SHA512
dbdaebd1b0af5c3d8e780791d27e412279dca9528a4778e360e8ccd055cc2a724060d9013765446cda76923b943b5e87d091f006123403261f8c5d6f1c97083d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1f95ee7cf50e15e75e35ab3ceacfc70e

SHA1
cbb01f323c0b99a4495f49c9d7a1849a8d939699

SHA256
8e79fba734d59d75ae221051a00b521ef816cda91e2ff9414b223c9096c533fa

SHA512
787892ae475061ee8ebb6f7fb1250a7407a24ada1257901bca07f1ec6dc7785f38eacb7b4c5716fa7cb9f70cfa3ba2314abb16a4e386c4ef03d39ee147c7eead

Download Submit