e41719dc5c72478a3fcd5ef67b1ebf496752dc78795f24f87636cd2b8bf65862

Analysis

max time kernel
146s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0a16eb28c9034e405f77afd28afc268_JaffaCakes118.html
Size

6KB
MD5

f0a16eb28c9034e405f77afd28afc268
SHA1

1aa463024cac2bfea277a00ecefb92d9a9e9aa59
SHA256

e41719dc5c72478a3fcd5ef67b1ebf496752dc78795f24f87636cd2b8bf65862
SHA512

67edd23b141cd0766a3d520e596a811c72f7d56f827ab2e4f1640faee1bd42c82f596ae2f12af015f9c56bd59091de11d685ae5554e68bab7cfbc3c786ce2497
SSDEEP

96:uzVs+ux7cmLLY1k9o84d12ef7CSTURg7cEZ7ru7f:csz7cmAYS/H7b76f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
2528	msedge.exe
2528	msedge.exe
4204	identity_helper.exe
4204	identity_helper.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2056	2528	msedge.exe	83
PID 2528 wrote to memory of 2056	2528	msedge.exe	83
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 2208	2528	msedge.exe	84
PID 2528 wrote to memory of 1280	2528	msedge.exe	85
PID 2528 wrote to memory of 1280	2528	msedge.exe	85
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86
PID 2528 wrote to memory of 940	2528	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f0a16eb28c9034e405f77afd28afc268_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd305f46f8,0x7ffd305f4708,0x7ffd305f4718
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5338417671330004390,8814249210591458372,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,5338417671330004390,8814249210591458372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,5338417671330004390,8814249210591458372,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5338417671330004390,8814249210591458372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5338417671330004390,8814249210591458372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5338417671330004390,8814249210591458372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5338417671330004390,8814249210591458372,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5338417671330004390,8814249210591458372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5338417671330004390,8814249210591458372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5338417671330004390,8814249210591458372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5338417671330004390,8814249210591458372,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5338417671330004390,8814249210591458372,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4137cdac56dfb2abaffcdf9d6763faca

SHA1
712b17c5dbf1ee79303667bcb6abe244a338f998

SHA256
b6316f5945612dc73d5af794086f860730d88210424031c046471dd341b318ee

SHA512
83cff2c0b89d24c5529e060f89925ee285ce7f20d039a0db624a63f368193f24bedfacdeb0e3ba9a5e0fdf826b56815c394b0136466822362a68e33a63f6c15f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87764a12f732824d60ea907572f441df

SHA1
0c1381fd6903f19e31c5d1080a9221f4c973f30e

SHA256
3d8b66fdaf729ec716e15eb856c8b442f4719e9a0a04d833fd27f767bb17b8fd

SHA512
ea4c9466b4295219962aac62182730e6c0875ea8da2e679083fc2cd771ab8c945fad46025a122b3269d02e6d13fcafb0fa976a3ffc8ed30c5d736be264a15e2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7897a7991d1b6ab281c4b0c8c7c9d264

SHA1
a05a3339569c73972f22c2c6664ed1d0a902c620

SHA256
1ee11f25a611c86e52eff37f718bec10c8f68f13e481abd2150b5967f44586a9

SHA512
d5d74635b2812386cde73b63347f89504ce76477bb0291f7320c76419923f1643cb951276a7608d2ef9b8b8042fd292984dc9fdc8d72a2d0ef9e1ed724e9afd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4af3f7a4c3207bfe89689abc34d09f9a

SHA1
1c13612916113e93c6aa2e527ba3244a6103b1a0

SHA256
e5576c60b1aab10439eb6bb2bcbe1d54b0d65dd684369913552bb72435c1b975

SHA512
a8056cef0380f38fd0ad897a0e354e95b475d1168a994076ca637520cb2b954022d28f1ae17ab66f87a1cfe2597e3a775a0a20b93a850b2364f26fe893ab9fe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3623b335cc798268e5797287a8b532fc

SHA1
559cc8c5cd086abd2735e8e23c3c064df755ed7d

SHA256
46555c030b2be5bd797cf6cd6c32798c4e832fe1b8cff22a1eac40fc9839dc1d

SHA512
effdfe961238b293d639337779980242a1c3515f089e68a0ab76f77bbbbfd0f18d3b87f21c9e0e24a344f605bb764b3ff64d7cfbc15fe80f8daba4197cb01fac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d6ef40a7eb67ebe9f654cea25285047b

SHA1
7dfa77b29f3f9848a0e2c985648700bc4decbc2f

SHA256
cec52738ce4ad5193bd149b12e7c2146eaf98994c0c5281a80d37aff0767801c

SHA512
cc5b05feeef33597bd615f23cdf4e0b7a99a011b356882f2ceb17af9a9b7715dcea79db71cd402b5fc289b17399a116d4bce7ad394879f1813118f0b72abc9bf

Download Submit