4b65ae395d1288624dbeb7b7078396aa45d4e1bd955a86389fcb855738ffb438

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5c4a4896ca328441590e8663405cd80_JaffaCakes118.html
Size

50KB
MD5

f5c4a4896ca328441590e8663405cd80
SHA1

44588ba21c6ea19845d3f26b64d9f723a051e859
SHA256

4b65ae395d1288624dbeb7b7078396aa45d4e1bd955a86389fcb855738ffb438
SHA512

6c62bc604987f9dd4a8d950475b55d79d6683a1cc6fb889116590472b6cff61f3116628d8c3ec3786be44894e14cb403516d9cccec5345af7019d3996e4febd6
SSDEEP

768:q5ugNV1qXwEQkrdBR7L0d8Bx1dsivSCoOUHLEm0a99999999998T80smWdNoZj:0u6iXwR86++1UJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
1908	msedge.exe
1908	msedge.exe
2092	identity_helper.exe
2092	identity_helper.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 4732	3000	msedge.exe	82
PID 3000 wrote to memory of 4732	3000	msedge.exe	82
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 2860	3000	msedge.exe	85
PID 3000 wrote to memory of 1908	3000	msedge.exe	86
PID 3000 wrote to memory of 1908	3000	msedge.exe	86
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87
PID 3000 wrote to memory of 4704	3000	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f5c4a4896ca328441590e8663405cd80_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb3fa46f8,0x7ffbb3fa4708,0x7ffbb3fa4718
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3164367219712909716,16169828826338572657,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,3164367219712909716,16169828826338572657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,3164367219712909716,16169828826338572657,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3164367219712909716,16169828826338572657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3164367219712909716,16169828826338572657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3164367219712909716,16169828826338572657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3164367219712909716,16169828826338572657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3164367219712909716,16169828826338572657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3164367219712909716,16169828826338572657,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3164367219712909716,16169828826338572657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3164367219712909716,16169828826338572657,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3164367219712909716,16169828826338572657,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\191e0fac-05d7-4507-b6b6-113ae06a3735.tmp

Filesize
11KB

MD5
4ca1f5d41ea55785d80c2c3d7519262e

SHA1
b90571f83997d10909f483b602bfdbb7788e901f

SHA256
a515bb46b0c8741cc7a151f0f8b9aef2a2d939d24ed8fef2c43e07dcba29d2c0

SHA512
e0f5282e462db395021759d4de967fabdf39dbb5267aecc8fa5c9fd26c038ad12e67c93408095530d2a7fb1a7b64bbdf19cca4152520cd8cc7084cf46d70723c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e2ece0fcb9f6256efba522462a9a9288

SHA1
ccc599f64d30e15833b45c7e52924d4bd2f54acb

SHA256
0eff6f3011208a312a1010db0620bb6680fe49d4fa3344930302e950b74ad005

SHA512
ead68dd972cfb1eccc194572279ae3e4ac989546bfb9e8d511c6bc178fc12aaebd20b49860d2b70ac1f5d4236b0df1b484a979b926edbe23f281b8139ff1a9ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
864aa9768ef47143c455b31fd314d660

SHA1
09d879e0e77698f28b435ed0e7d8e166e28fafa2

SHA256
3118d55d1f04ecdd849971d8c49896b5c874bdbea63e5288547b9812c0640e10

SHA512
75dce411fce8166c8905ed8da910adb1dd08ab1c9d7cd5431ef905531f2f0374caf73dedd5d238b457ece61273f6c81e632d23eb8409efbb6bf0d01442008488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5ceda579e6d88d929eb21d7689f3405b

SHA1
f4fd9497b29da601ca86ea0405102101c5278543

SHA256
c289b9eda1fa06f771b00134329158c0af9993696b62986f337a7eae951baef4

SHA512
44ab20fbb8b4ccf0734b9a79a59bbff2ee66e11e540ea7447b6172df3fcdb112b78fa87e4a7696e1463a40bbd99299e36141563e45720f80a2812929031ceaef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d73f94bfa25d7db828060180bae5720

SHA1
040f8ae98d980d4020196cbb9a7fb18d29188301

SHA256
9b4f939f395e4ade2d78a7174c3c68bd6a2595d363ea929bd7be4c60848fedc5

SHA512
b2e2bec5f4a92f6f0a8912852d725f7b5ae0e652c443a6cb0c6d8de82798d9572c2627fdecad20e174ea0155d3b65e8399b2fd4cc9702063f26d29d72c67a8e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit