cbd763fa8a7ebc67ea1a7cd04a1f59ba7344c4dfdd7a8b79d5fc5d7e934d8406

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

679095cf66a2832bd0a73d84a82b7da4_JaffaCakes118.html
Size

6KB
MD5

679095cf66a2832bd0a73d84a82b7da4
SHA1

3c24b86759011277245be7f3a770deb2f958e22f
SHA256

cbd763fa8a7ebc67ea1a7cd04a1f59ba7344c4dfdd7a8b79d5fc5d7e934d8406
SHA512

2b7f1ce45ccbdf9fd985ef293a6caa06945f692ce29968575200fd2903b6a1d8daa8e91086a32a25cfa99021b0f124f2b8a101f35c79eb40766d8a2131a5ac93
SSDEEP

96:7GOZNwQ9nz6BHkPJZPEAz9zBeJIQeTP/OgkHbYk4E4YHrE5xeplSnTQ6wQAucBxv:71ZKxGQULrZ2T7BP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
1328	msedge.exe
1328	msedge.exe
444	identity_helper.exe
444	identity_helper.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 4908	1328	msedge.exe	84
PID 1328 wrote to memory of 4908	1328	msedge.exe	84
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 464	1328	msedge.exe	85
PID 1328 wrote to memory of 2312	1328	msedge.exe	86
PID 1328 wrote to memory of 2312	1328	msedge.exe	86
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87
PID 1328 wrote to memory of 4424	1328	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\679095cf66a2832bd0a73d84a82b7da4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8e2646f8,0x7ffa8e264708,0x7ffa8e264718
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5559885556543903914,4764890868845747642,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,5559885556543903914,4764890868845747642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,5559885556543903914,4764890868845747642,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5559885556543903914,4764890868845747642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5559885556543903914,4764890868845747642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5559885556543903914,4764890868845747642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5559885556543903914,4764890868845747642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3056 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5559885556543903914,4764890868845747642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5559885556543903914,4764890868845747642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5559885556543903914,4764890868845747642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5559885556543903914,4764890868845747642,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5559885556543903914,4764890868845747642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5559885556543903914,4764890868845747642,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5559885556543903914,4764890868845747642,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1f9d180c0bcf71b48e7bc8302f85c28f

SHA1
ade94a8e51c446383dc0a45edf5aad5fa20edf3c

SHA256
a17d56c41d524453a78e3f06e0d0b0081e79d090a4b75d0b693ddbc39f6f7fdc

SHA512
282863df0e51288049587886ed37ad1cf5b6bfeed86454ea3b9f2bb7f0a1c591f3540c62712ebfcd6f1095e1977446dd5b13b904bb52b6d5c910a1efc208c785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
60ead4145eb78b972baf6c6270ae6d72

SHA1
e71f4507bea5b518d9ee9fb2d523c5a11adea842

SHA256
b9e99e7387a915275e8fe4ac0b0c0cd330b4632814d5c9c446beb2755f1309a7

SHA512
8cdbafd2783048f5f54f22e13f6ef890936d5b986b0bb3fa86d2420a5bfecf7bedc56f46e6d5f126eae79f492315843c134c441084b912296e269f384a73ccde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8df6cc63e68d69b0df74673e9d0ab190

SHA1
c42bfec74eb6dcc3395d53c9c1f6b206c3c6d526

SHA256
fe998fa52ef2e697abd460ddc9fdfbfe105dbc27202b8f24ac9661feb4528b3d

SHA512
c2ec974d3160c1a957a96a0d84a96bd278bf4e61e2ee97c2a8a5adcab3fd06588d2ef6a7fe5365c3fa34ebc6d3c79e82d2b8f8489990696d1126ea4f27dd7ea7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9ebc3cb1810fe51db0d3ce97d9b7517d

SHA1
c0d4266a684ed3b8b9449a6c4e19700b1a43a86c

SHA256
78e29873e95cb96edfa8ca8bde9e694d7bd09721011742b8fcec0b4b0352e83b

SHA512
0bb9d8e6c820b9d569c5cb21ab279903d1bbf58feb7725823cc21ab5e7bd27e7eabbfad8f2783a4476a2dd25f3aa9772af20a1d3c21041cba917c145c4056dbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d4b0c04c9983599af56e5df1b103ca23

SHA1
4b4203b705b261af21621029c3c10a2cba6d9eac

SHA256
e224d3208072341852115739d943cfd829804b0ccbb8250c3384c75d40f108d6

SHA512
df8e904700f890baba150c01adf87a405aa4a087df66e87cfa2649aca132d69914d6e5162f4fd8619cfde013c058d434c6679436f24640ba2b06b40b1332219c

Download Submit