f01704191351aedb18e9c6f8a1447f747be06be63f0181faa7c2666e4aea244f

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f355e6b8b2a318433a08b3ff5da57f7c_JaffaCakes118.html
Size

842B
MD5

f355e6b8b2a318433a08b3ff5da57f7c
SHA1

b49119a3fee7b2a0f4d6f3aa1fb7399e9cc9a6a9
SHA256

f01704191351aedb18e9c6f8a1447f747be06be63f0181faa7c2666e4aea244f
SHA512

b6ff876243abe39399de47ec9b51a5ad5c18ed82e747745e971533e84dbe14781bd0a5d1e168c8284092f0152e771e4771c0e836adf24e7499169cae0f9c8827

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
672	msedge.exe
672	msedge.exe
3332	msedge.exe
3332	msedge.exe
4624	identity_helper.exe
4624	identity_helper.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 3200	3332	msedge.exe	80
PID 3332 wrote to memory of 3200	3332	msedge.exe	80
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 3652	3332	msedge.exe	84
PID 3332 wrote to memory of 672	3332	msedge.exe	85
PID 3332 wrote to memory of 672	3332	msedge.exe	85
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86
PID 3332 wrote to memory of 1992	3332	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f355e6b8b2a318433a08b3ff5da57f7c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb38cc46f8,0x7ffb38cc4708,0x7ffb38cc4718
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,10911259118987068654,4661039963927234065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,10911259118987068654,4661039963927234065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,10911259118987068654,4661039963927234065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10911259118987068654,4661039963927234065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10911259118987068654,4661039963927234065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10911259118987068654,4661039963927234065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10911259118987068654,4661039963927234065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10911259118987068654,4661039963927234065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10911259118987068654,4661039963927234065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,10911259118987068654,4661039963927234065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,10911259118987068654,4661039963927234065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10911259118987068654,4661039963927234065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10911259118987068654,4661039963927234065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,10911259118987068654,4661039963927234065,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5272 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7068dbc5d66be9ce2817196103217ab

SHA1
ecc24ad138e575547b358803789f6ee31a66260a

SHA256
b89d90e5fc2e8b7e9057196ca5caa49e1974ca4c58b95d779f95393bea6373c5

SHA512
5f429904ac12a13d3889874b1f2cc9c05ec5f15a40f844e74a91e8294e6af344c5f1b1fa72487a5e4759a703f8e5be0f8906f7310f9d3553875a08024c627960

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c4e86f72f6f2bdd2f68d77a7f5477091

SHA1
e489acc011f1c8edca2308577653e19e0daf2974

SHA256
2abddff8823bde0650a10297709c4ea22258a3e5c79620805f6da52664eb762c

SHA512
ca6093a136006f6808ce12a1b3e92dd8f53d6500ed253ecfafa8aa5a97e375641df25b0f3360acf6e063e9ee8bdb814c469973fae663a217cc0932c9122a746b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
189B

MD5
397f53f29a17baee00697ca31a738b65

SHA1
bc300bb2b7797ab6c948a77db2cefad1361d0f7a

SHA256
0dba79eb79d62dbf47c0a71d0802e2f473818740fd5869140da4dbfa54582948

SHA512
b2857d010ac2c15a16838ff92c50042ebf687e293f05bef559769768fc214032dafa75d0ecb41554122b647294999cbc41cfa3c8e3bf9f5bf8d02a32fc057817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7d66982c7574b3b4b307eed2b4ff0890

SHA1
12c5874cb712d4db74d948a07b7397b2b0f478c8

SHA256
803598c8bc502a329291cd0774699f91c8800b733a4177abace2be8596d90be6

SHA512
845c7caed24d4724cfb25d2033b05904864a4aff1f3bcc25850bd8faf929dcc8eebaba5c41c6a8c9b626b5b96a6e25e22cc91af9d2b48f174b1385f2094aa662

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
66cf231e82c164d6879242d3035b7733

SHA1
0d1e84f2b0fa343143ed4c976ec7386b3b263be0

SHA256
78b16d5c97e114530a9ca23bc9564d195e9d394180134410b06cc5d8e562523a

SHA512
525e3ca75599d6533cd3ee23e2b4a00b3df0901c359bc1551fb4d61e3e4c1e7e4ea43c83d1b3d182af7de3271a26a04ab61101e59a8fe994604ea9f39a7f21c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
9e699fa6cf4922d4d223dc5d994fe9ef

SHA1
4c201219f45689ec69e236a99e2b8783222c6d25

SHA256
ccdffba38d1a7abbf06e286f7a360718f52a4b6c8f4f7d87394a86d44f862ed0

SHA512
94a8e29d6f5f5d780b567fb23f0973bef99ecc173249a79b90965fe3ddb2abce4dc48d3ca3ee3270e4f58416eaefb4ae1fb99ea59a266853fbd2e1efe8cc83d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cda68d69650364ac63623e9c36a70eee

SHA1
b90d3f62e7de572a34d8d941c8ee4df3e7892fdf

SHA256
7c82e47626e22a5f0ef5b66ab086f4bfcf9b349db304a2a05adfb6c283c421bc

SHA512
34783ae2580e3ca16ac3e097f011a3dfeca96c241740f205c614c57055af75c1928965e83c822521bb8829b0333d388761bef003203956d566adb0d86dfbc437

Download Submit