6cb5fe5354566c64fc345843116e68c53ea4613db28f7a97b5801ec2e3c1fa7f

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b3786738cefc476a64973c9aa1a6793_JaffaCakes118.html
Size

537KB
MD5

0b3786738cefc476a64973c9aa1a6793
SHA1

d46da8ae500641d3ff80dd3af3b9e62b680bfc24
SHA256

6cb5fe5354566c64fc345843116e68c53ea4613db28f7a97b5801ec2e3c1fa7f
SHA512

a6ea4b5c8256d63cf8f35d1c63869967b582b97633c4d23487036dc4dfa827ad931b549168bd77c9e3e91a57106a6e1c12855c2c90bacceeefad8a1715e5a710
SSDEEP

12288:0vvbGLvb8vb4/taLvb8vb4/sL4dX/QQealg:wvb0vb8vb4/Gvb8vb4/rg

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1260	msedge.exe
1260	msedge.exe
1656	msedge.exe
1656	msedge.exe
2132	identity_helper.exe
2132	identity_helper.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 3252	1656	msedge.exe	85
PID 1656 wrote to memory of 3252	1656	msedge.exe	85
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 2688	1656	msedge.exe	87
PID 1656 wrote to memory of 1260	1656	msedge.exe	88
PID 1656 wrote to memory of 1260	1656	msedge.exe	88
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89
PID 1656 wrote to memory of 4012	1656	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0b3786738cefc476a64973c9aa1a6793_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad7ba46f8,0x7ffad7ba4708,0x7ffad7ba4718
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1707033742606464720,3157814838798382012,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,1707033742606464720,3157814838798382012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,1707033742606464720,3157814838798382012,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1707033742606464720,3157814838798382012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1707033742606464720,3157814838798382012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1707033742606464720,3157814838798382012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1707033742606464720,3157814838798382012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1707033742606464720,3157814838798382012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1707033742606464720,3157814838798382012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1707033742606464720,3157814838798382012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1707033742606464720,3157814838798382012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1707033742606464720,3157814838798382012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1707033742606464720,3157814838798382012,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
649B

MD5
307bc24914f949b15ccefc5ad97bde63

SHA1
5a289e480be3bc401836f1ba221f6ffe7977830b

SHA256
5caea4e338dcbf0116367a59ae8ede78de9a12e26ecacc423bb65360ff8f1987

SHA512
acf512227b150f3729ab04a03b7693255dee704c5bb2ac24431c081e935908dc669651e651eb0b03fa98c2038d9ce3af6aeaf70c7db05dcc8f58aa8298689cfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c4b13965677928200dc95b96318f172

SHA1
9954849f17f37a23f4986c07b11960b0a864b803

SHA256
c8ab1ccea45a1a329cbbf20b2453d5f103a62f20e7fa4fdbfab202053a5aaf41

SHA512
3346ce1bd7615ad06b0831ec42a8f6ce2cc13c0b1815b3e34af5a491fac6f66e6c26842a94b67da38100c3a1ca29d6b44125b67a1eb382f7a6ad8ebbc6ca0651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
073bb5ca1353718a021e43cf05769da7

SHA1
5f18d6f4dc0c5ceb71330435fddea8e45f9c1d4e

SHA256
d3814e75778b73eef56f9f38cb3c17bd12ef4cde042e5b2299f956f6cbd7ebdc

SHA512
d645f4d25d154fbf85fe30508bc1e44062788372eea09277dfec04ddf8cce7ec1292bc381684f354ee438e87475c765cdeb0c040018331686b0447f524fefdbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fef258c9c3430311005ec5dfc33e5694

SHA1
5e97f9d13d1ec9d6547c9e1044ad3e66b76b5e4d

SHA256
f1a760d8d6e3fdaba096c9ee55c102375535acb63b34f8372f28fd20f69da405

SHA512
0fd21ba837e6ec57c81ae1be5d5a43c2f5f6e15c6e6dd01ccacf5f903c9490a006f2f8f19438c96aef8ebc3c7cdbb0f786dda1fe96f82f5c2b9f291ef7262949

Download Submit