a8b3b4f725dfbf63bba9888e6f6cc37913abc3afda4c200b8b621b9e57f12b19

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ed3c920a3ce80e06528f6f7d6d4571b3_JaffaCakes118.html
Size

327KB
MD5

ed3c920a3ce80e06528f6f7d6d4571b3
SHA1

3d292d1c0f6c61c2794acc2d0d10f7d1e7293761
SHA256

a8b3b4f725dfbf63bba9888e6f6cc37913abc3afda4c200b8b621b9e57f12b19
SHA512

31c49ab97eb5d8c17200bfa2b52a03916cbc4c52717809d48bd6ef3f3d541b71eb1330f0ff65cab6a38d4624d94145157be62ab82d250dd14e38e973c1225539
SSDEEP

1536:AnasqpFO44t4oqKwaKwa4Ti5FoBTtEZx9JqNZ/V1TRixjdDsd7XQ6WjZzrk+yH+v:QFBTCZJqjN1ToXDsqHxkx+XTx/Vf2Ba

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
944	msedge.exe
944	msedge.exe
3992	msedge.exe
3992	msedge.exe
1036	identity_helper.exe
1036	identity_helper.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 1464	3992	msedge.exe	86
PID 3992 wrote to memory of 1464	3992	msedge.exe	86
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 2780	3992	msedge.exe	87
PID 3992 wrote to memory of 944	3992	msedge.exe	88
PID 3992 wrote to memory of 944	3992	msedge.exe	88
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89
PID 3992 wrote to memory of 1624	3992	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ed3c920a3ce80e06528f6f7d6d4571b3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe19a346f8,0x7ffe19a34708,0x7ffe19a34718
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,6549279138163501238,11409718083797638179,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,6549279138163501238,11409718083797638179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,6549279138163501238,11409718083797638179,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6549279138163501238,11409718083797638179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6549279138163501238,11409718083797638179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,6549279138163501238,11409718083797638179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,6549279138163501238,11409718083797638179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6549279138163501238,11409718083797638179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6549279138163501238,11409718083797638179,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6549279138163501238,11409718083797638179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6549279138163501238,11409718083797638179,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,6549279138163501238,11409718083797638179,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5400 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
511B

MD5
3b0c1f88d25657a19a0ef2fdb3b65f66

SHA1
5f47386c5a53ccbf2652d04ef5d39847c2d8d9d4

SHA256
722e9a81bb140d204655b416c63361bbeb7db75be9c71e8c04751113dc52806a

SHA512
9e53fee4c6623b1d7178f434af30a7403031de424c883ae2987957a4dc355a60fd5a013984dcbbd2718be344d6cbbda73da76a1fce43e50aeec2a4c479c194a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
68d6956a39621713bb8b3242a10af0ae

SHA1
1a2c6032f65f98a13382940d463142c7f40c1533

SHA256
4b579396746c0a476bd9039460e5e971caad9a7d5781025671f5dd6a2815107e

SHA512
18cde3d972815494519139512e7018c542fddc6e0164bebb5c168cac564d083ff7f13e28b54631debb4f52247d8c45cb421e14e126cc4fcf10ff00ca01cfa46b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
17d8edd7d3cdd0d84afd8695cadf1615

SHA1
4c1d7a48a6a4d7f4022e39c8fb1dd692ebcf8d4b

SHA256
fb7359adeb655af95b817b31645597b38d63c4f81374b0a432332ab52fc71e38

SHA512
a29f5e83b136014b155511b30c6e70a99a5f3730a64851b1631f510be63c8c1a7367572e019f1dfbd358d25e4c4c8777e8af771c25139de271e23955bc33bade

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b42c546df1cf8f5a557110fe8e728f45

SHA1
d1d9b99e52ff17920442c34921470f95e7312afa

SHA256
65ea309c61919bc1b0e9478eccd6f3759390448bbf9bed463d3ef646614ad7e1

SHA512
cb457ac8533e610d02e6f1ec2c12f1abce03c9f1b7bdad2666f0b63c20eb5cbdb0e8bef8d4d02e293c206303518074f81f0e3678859c7048307f5df15a03d4ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4a98c4cda23fea44052529789e7ca0b0

SHA1
0cfa8eae0cd365ad03f4dcc47bf63c99bf4b4ebd

SHA256
0881451c6ac94f86358b3132820f8f37a6109ca03c49234cb78b5e742be24bd5

SHA512
ff03ec782465c9879af72a91ab9f02a31f6f44febdd315d6e89f76a160b50c55caa31f727e10fe5b79aeba2f536f04b2489a0575fc3cdbc7d0febe0b0d419a54

Download Submit