7138d49abf3355b6cdfc56d8d251132225ce7281bc1f57df1b4fb60875d30fc6

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19bd9ea80943cebbf4a66b96aaf75137_JaffaCakes118.html
Size

45KB
MD5

19bd9ea80943cebbf4a66b96aaf75137
SHA1

34821e31288732afe2e5f81c1d5c4c53ce7076b9
SHA256

7138d49abf3355b6cdfc56d8d251132225ce7281bc1f57df1b4fb60875d30fc6
SHA512

98e372288f88ccc809e1a43a34d065a0ae89699ef6b57d7507a1fab54bd274496d5304d41d7e09cf3d77abd953212887deb7119353d1e89a97b5d8f834ed90d8
SSDEEP

768:GiuIRIOITIwIgInKZgNDgIwIGI5IvJ7SJIRIOITIwIgIOKZgNDfIwIGI5IVJ7Sz5:cIRIOITIwIgInKZgNDgIwIGI5IvJ7SJ+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4176	msedge.exe
4176	msedge.exe
4564	identity_helper.exe
4564	identity_helper.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 2384	4176	msedge.exe	85
PID 4176 wrote to memory of 2384	4176	msedge.exe	85
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 456	4176	msedge.exe	86
PID 4176 wrote to memory of 4872	4176	msedge.exe	87
PID 4176 wrote to memory of 4872	4176	msedge.exe	87
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88
PID 4176 wrote to memory of 1376	4176	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\19bd9ea80943cebbf4a66b96aaf75137_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7fdc46f8,0x7ffa7fdc4708,0x7ffa7fdc4718
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15561386831349531128,14465433021064458521,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,15561386831349531128,14465433021064458521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,15561386831349531128,14465433021064458521,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15561386831349531128,14465433021064458521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15561386831349531128,14465433021064458521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15561386831349531128,14465433021064458521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15561386831349531128,14465433021064458521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15561386831349531128,14465433021064458521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15561386831349531128,14465433021064458521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15561386831349531128,14465433021064458521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15561386831349531128,14465433021064458521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15561386831349531128,14465433021064458521,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
822B

MD5
a611c33d3e16ae02601ba454d9af9fa8

SHA1
943a10f3bc0500128eea37208805b561e79ae90e

SHA256
d3139d30efbe904c02da92085a5dddfa653ab0ae8e958c7c416054f6445227f6

SHA512
4a341ca6e2613a475833bb89e02201fce1ad9716f6e9d1f6ef330f471ff6843245b4ba92db251771c4b449b2ccf33b7f28554b543a562eb2b5b0d71f1a1d772b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9cf6064e57eee65c32fc9a4e5bae7d4f

SHA1
41e426e36a996f21eddb084747fd599c459f7146

SHA256
a7b25e75b2a3a8ca37868470f7ba6e5f9cc9ae932725812f376cc3c7c76ad376

SHA512
478e2762f16adefd741309bfcc255ef394e364884ad85f92814ee839dbf4d519d03ef06cb6e77cd067f44167f5371314811a6689293bcd7a08b812b6072327b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ba95461a23ebbd2ef8c2b483a251aa9

SHA1
fab3c0a98e9017956ebee3074a6051959f2ad65c

SHA256
34f15fd27217fe49a411a549888f7006466e2c0c526916c837e7f0be800dc9f6

SHA512
a0b1aafb92b8a3e705c48b86b210ebec53eeb7e01ceed419e646f5d3b5dca622d9230339f40d9444912f8f3518f356e13804f9163eba679b3b3ce5497b901c81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4d2cc93db4624315bf9cf99cb60a73b6

SHA1
cdda1323ff2c53418f1c42105a28d7de4576a3db

SHA256
373031ed16f94cd0961fcc8073178d97c97cbabf158523e0cf70316555eae531

SHA512
041ddd33c513a25a471d87502ec8c097ff4704dc047fc23328bbd28edb9567d8bdd6f18c0cfb3a66e2bd47b905656060688d918d470cd3fef63c753f4ed41b2e

Download Submit