9e0b7c8ca6ceea7f93c5dff85759090254dc2eb825f21af1eb31e792b2403dcb

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc819961caf1b4224724f060ec3c3720_JaffaCakes118.html
Size

110KB
MD5

fc819961caf1b4224724f060ec3c3720
SHA1

df81f9a5c71c41937119e54bfffa9ec7e7bfa7e9
SHA256

9e0b7c8ca6ceea7f93c5dff85759090254dc2eb825f21af1eb31e792b2403dcb
SHA512

6330f870bbb7579ebf0c350ba7d48ba5eabeef70f4c8aa53c46618a83b2650ebab850f1cc7be2f9b84a8c3d912a850d6bc92ebddf7a3fdeb33203161994b58f5
SSDEEP

3072:lYHDZ6Y/s/MmR9LWEINhl5vkXZR0FNKOPUmi3:w6Y/1NEAp2ZH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1992	msedge.exe
1992	msedge.exe
3172	msedge.exe
3172	msedge.exe
2900	identity_helper.exe
2900	identity_helper.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 3684	3172	msedge.exe	85
PID 3172 wrote to memory of 3684	3172	msedge.exe	85
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 2044	3172	msedge.exe	86
PID 3172 wrote to memory of 1992	3172	msedge.exe	87
PID 3172 wrote to memory of 1992	3172	msedge.exe	87
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88
PID 3172 wrote to memory of 4872	3172	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fc819961caf1b4224724f060ec3c3720_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91cb146f8,0x7ff91cb14708,0x7ff91cb14718
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,11057249523033351593,7968863963164439092,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,11057249523033351593,7968863963164439092,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,11057249523033351593,7968863963164439092,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11057249523033351593,7968863963164439092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11057249523033351593,7968863963164439092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,11057249523033351593,7968863963164439092,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,11057249523033351593,7968863963164439092,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11057249523033351593,7968863963164439092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11057249523033351593,7968863963164439092,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11057249523033351593,7968863963164439092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11057249523033351593,7968863963164439092,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,11057249523033351593,7968863963164439092,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
308B

MD5
2c65dda2b3fa105a07ef39addaad06a2

SHA1
33fdaa11bf640d16812cf7d3a348ca73a8bab66f

SHA256
a1a066a9e50a2d62c47d2ff5fd616f2dd7c1fa6e623f1bf433d9792602319858

SHA512
46a15d581596ccb5e1b4683557ee62200e93257afd03ecb61dca99104f6ab3614130c8b955ffce76daf4b38277f8a0ee6e0bfcce341d6625bb6dcaaf0ea0c1dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
23390c702a90bf05922bbaee3be23403

SHA1
53bc03b4c643d58cdc41b45b415fb968572e0d83

SHA256
1a630b27c55bbb7257b3a09df4d1ccdcf8a0b4ca7844890057b4c55288218ec8

SHA512
0e1b1ae731e5bcbd86f9ce7b15d6cae0fc99ad0ccea6a697141c8e5e2f12fbbd8d9dfccaccaa6b27eb7f3d8a424e7f19a0ef848931295422e8f5513f92ccbde3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9a4bd9db2c0e49aada619a1375f270a

SHA1
e1f0792c534e6ae85d9b893f943b29b49bd14265

SHA256
8611b47305e6c92b5185443c5f55e8ce6ad69d20ac2952f25b88923ac4f65ba4

SHA512
635b6a5ddc7fa78a9783ca138e1ba1074ded29aa336ead4db6d0fcfd3b966d0bb0bce5ded87626ea443798bdd017069fd3d0367f4bfaa16a39f7e424fd3f50ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a4789d41412b55b52e5bf28951f8a61

SHA1
da519f5b1a9d22002bbbc19d2867e9608c40825c

SHA256
979df772f10fb372f54b1e783b7a62bf9fd28c52f6f40a931f9d7db3dd82e7a7

SHA512
ef21c3f8c822bc6959d4b2c038e8dbe430e62f01ee32bb4dc7be05d86509a982ddf2b7e8dc15f502d2a487ab11430448964d2c07fc5cab2001b53c61962692fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0a4214b48cc25808aaea7185fa9f73c5

SHA1
46d14e37e567774ff2c92a2dd15401ca1a83457a

SHA256
19e1b5f03f0f8b4f12cbba734ee8774710ca6755c8b1d5b5672fc9d13b23e50c

SHA512
e87aa4409d9c6435a4ed95744efe23184536f61fc6dd6730e1fa6c7fcefcb1e045bfaa2b275abb09c38645db74982fe37d97b9f9f3d4a2b7000a30b90b993a41

Download Submit