698dff551e793db458b0987d1b9f4e67c8fe56ed4653d05663cdbdc66880539a

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f04e61b06e0931b3224299fe1b70934f_JaffaCakes118.html
Size

8KB
MD5

f04e61b06e0931b3224299fe1b70934f
SHA1

4bdce69a4589bf1bde02c3770074f49e2365d669
SHA256

698dff551e793db458b0987d1b9f4e67c8fe56ed4653d05663cdbdc66880539a
SHA512

d0abced7be62574e4988d1c9cee4468ea8504a95da94de15cd3f3285e2cfbd32f61b345be5a0c9f037d50b9a1bea99d087e6f6af26c3e744d657a1ee624cff59
SSDEEP

96:KHTvb7Wym27vFWyC27v0Eu9/+8ChyhqrdRUH07q2+h9HX+MYrzmWAWQUz:KHTvHl7vFZ7vdE5CYQErhp8zmWvQUz

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
2876	msedge.exe
2876	msedge.exe
1740	identity_helper.exe
1740	identity_helper.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 4484	2876	msedge.exe	84
PID 2876 wrote to memory of 4484	2876	msedge.exe	84
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 372	2876	msedge.exe	85
PID 2876 wrote to memory of 3260	2876	msedge.exe	86
PID 2876 wrote to memory of 3260	2876	msedge.exe	86
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87
PID 2876 wrote to memory of 1748	2876	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f04e61b06e0931b3224299fe1b70934f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98e8b46f8,0x7ff98e8b4708,0x7ff98e8b4718
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5699441945173171854,9340456548848155754,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,5699441945173171854,9340456548848155754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,5699441945173171854,9340456548848155754,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5699441945173171854,9340456548848155754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5699441945173171854,9340456548848155754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5699441945173171854,9340456548848155754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2988 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5699441945173171854,9340456548848155754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5699441945173171854,9340456548848155754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5699441945173171854,9340456548848155754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5699441945173171854,9340456548848155754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5699441945173171854,9340456548848155754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5699441945173171854,9340456548848155754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5699441945173171854,9340456548848155754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5699441945173171854,9340456548848155754,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e2ece0fcb9f6256efba522462a9a9288

SHA1
ccc599f64d30e15833b45c7e52924d4bd2f54acb

SHA256
0eff6f3011208a312a1010db0620bb6680fe49d4fa3344930302e950b74ad005

SHA512
ead68dd972cfb1eccc194572279ae3e4ac989546bfb9e8d511c6bc178fc12aaebd20b49860d2b70ac1f5d4236b0df1b484a979b926edbe23f281b8139ff1a9ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
864aa9768ef47143c455b31fd314d660

SHA1
09d879e0e77698f28b435ed0e7d8e166e28fafa2

SHA256
3118d55d1f04ecdd849971d8c49896b5c874bdbea63e5288547b9812c0640e10

SHA512
75dce411fce8166c8905ed8da910adb1dd08ab1c9d7cd5431ef905531f2f0374caf73dedd5d238b457ece61273f6c81e632d23eb8409efbb6bf0d01442008488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
f6b38c09a478ad6c6b1b9ca4ada6e6bc

SHA1
9a07606b387b973671aeadc1c73dfbdee9c87879

SHA256
801786196ff53636c21f3d4279611d42957ba8e1d0d5770fbb92ecf4c62a64cf

SHA512
16141089d35371cdfd3c159048bdd47660d644037656fa7819b8ee11dee1afc69d99eb4696135c8f2b036579239035fde4636110182dafe62ffaa6b45c6afe16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1004B

MD5
0a3f28a59981aae90884208a8a8eee28

SHA1
f8898129df23187f600672e4725cd9b76c267ec7

SHA256
3640e4a4f3568e8f1118267ba01b762628f6dce366459eed94c2fb8339bdc54e

SHA512
6120c1698e436d03773a668d3552d9563272ea5ebd6cee23f7755cc68febb89b03d48b4c2bbd72368af949c3e70f1d46b6e65381f5fe4421bbe760bc7d391afe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
47b25fea6d10ab7779d0357587fa96c2

SHA1
e813179b8e4f5142afac57b752c1f46e80887205

SHA256
30c598a1b32c93276b99b9958ee773e91662d5954aa3547307dbf4339bfc43fc

SHA512
ab12046764050d2965cc7c936a9eb65fc53de021cc9aa0e7f097207e05b27835a0f7c618699b9b1ef9da2360198a50d77c259f53ee577c604fd40cd822ce1608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b003b6f30aa12de84ebaf59aca4590e

SHA1
813b030c678aa4f9ba7f0e8dc97b70582ad06deb

SHA256
5b52169eba3bec80ccf8f22c423e1d6d769d801276508d9db2bb4189b09b252d

SHA512
42bd2eace4d40a2a68db625f91797cb55d5f64ba2822af4c98fdae52c2d21fd9fa0d0fb0f7f2003ec6ccd02b06daf0d220a50faffe3f9a3869319dc7cafd0c4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f6d955e3295ae20fa4a57c6f23267bfe

SHA1
0fff2d4643395713b99c97984b8cdfa63f9936f0

SHA256
4e060128d2dbd64f28c40cb5edaceb6241b80f079d184a2cb60604b52205651d

SHA512
073468c631adc09647b711708f2f362b47b3bec9e660f4fa63baa4766748c470e02e21cb3c115a50ea6e7d174087a792fbf0ccedd24b040cabbd09cd486fa282

Download Submit