0050e2b2c338481a18c195bd0bad3849e87ff6b6dd913192708ac8d3099dd30f

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edd0f3e947ce6c8134dbb61fa5d615f5_JaffaCakes118.html
Size

69KB
MD5

edd0f3e947ce6c8134dbb61fa5d615f5
SHA1

bb2e46bab8600a291c465325f8646a2da9929454
SHA256

0050e2b2c338481a18c195bd0bad3849e87ff6b6dd913192708ac8d3099dd30f
SHA512

7c3f9fd1d2dd10f7e439dbc7e4fa2fb3b70abccd3497341c9ebe2a71661a4eae220652c087027f08a7e230e31577799404edc744d2b23cfdfb4577cfef65a979
SSDEEP

1536:tfIRIOITIwIgIlKZgNDfIwIGI5I8J7SYIRIOITIwIgIHKZgNDfIwIGI5IvJ7SBQW:tRQhVUpfipf0/+Xxm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
4920	msedge.exe
4920	msedge.exe
316	identity_helper.exe
316	identity_helper.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 3724	4920	msedge.exe	83
PID 4920 wrote to memory of 3724	4920	msedge.exe	83
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 552	4920	msedge.exe	84
PID 4920 wrote to memory of 5032	4920	msedge.exe	85
PID 4920 wrote to memory of 5032	4920	msedge.exe	85
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86
PID 4920 wrote to memory of 2468	4920	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\edd0f3e947ce6c8134dbb61fa5d615f5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c04c46f8,0x7ff9c04c4708,0x7ff9c04c4718
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2320 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6ad95ce9-dc58-42ae-bdac-e6c0e842d6ce.tmp

Filesize
11KB

MD5
c6382490b1617e93bf320fb5177da1cf

SHA1
2ea2e8673a0a8248ae7604b76526c62a412645cd

SHA256
44792ea756da9ddb8dbcb495f0f967d2630d01c1d4793e948ff3edabccb2d8bc

SHA512
92293db72a36fd518d0bb85da60e53a3d8bc1acd8baba39a82eca3bebb262d1764e52f9f68c3f860434c335be330fa90a3365be293ee64dd7f5b4baa15fcad12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8fb6c324-7b00-4c70-bc6f-31496d6cbe7c.tmp

Filesize
6KB

MD5
54b191e58be47f00258f3b349319b306

SHA1
8bf73ef3243fe65fd2fdf28c8ffb3f94e6bf37e6

SHA256
525cb93de1a2dcdff8d051509e8032da5bc4ed542856186ffffac4b44f476303

SHA512
4e715bf7013c90bfc64ad79359eb4de3ebcdf23d5fda3944039d4a38ab7e20bde1b6b6d05bdfd8c35d5595cbc2ce14b1c2867f5f8d2b18a254c52d4e975b9b3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
308B

MD5
1989c654fd719d642508c7e12b4384ce

SHA1
d05ecc36503a1d7815a23e6cbf798d4390c64746

SHA256
4ee0ba8b755b84ad52a88c334ff965589e83cf554b06c936c5990045eb0c42e4

SHA512
5cf8d7ede462933ee0e78ae168130bb9c050c2613389078a7b40d168493575f6ddbb50b735c713a59eb626b8324e00cf777848d525fdba4790481c5fa7cd550b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db5c5c987f5fa91967917754464fcebb

SHA1
b897e4a629354eb07f9bffbfe246b3cfeb5f6287

SHA256
1de3f538f9a51986e1709be5f4354a31f4996435653c4ec11666222754c26977

SHA512
fd144260b0341872535eefa9a2b82b1e0e6fc9249e3b053e9039f699d0f2c36d91ff3d4a94d991b54609af9d89275bd26fbb5575decff89a56cbcb511b0911cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f1889716d90e7ec67b72041ebbecdea9

SHA1
3ad482831b19937c30bbd1362f4e8ba1c224e887

SHA256
32efb4b101d7950b032549148cd7a5755f882960e4c3a57bdd91b3bc04a44c45

SHA512
cc0bd6d0cd94d884a827b1a7736421d709f4d8dc72af11b47d66d9ec2f0f6c82cd25d8c79f6714b15b083eedba53489a29e4a8562b15115e45876e675194f093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit