b0747c8caf489cf563265166f6cc96c7660cd39782a6c7a00088406acf6a1ad2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fda15d23244083887a3273e0739f5825_JaffaCakes118.html
Size

73KB
MD5

fda15d23244083887a3273e0739f5825
SHA1

824ff0d0f169fbb52cb1cbc8a59814f14b2c8e36
SHA256

b0747c8caf489cf563265166f6cc96c7660cd39782a6c7a00088406acf6a1ad2
SHA512

fe2348713aba7275923f46d7e58373ab001e0b1937e08b6e37cc51304cde7e5afb81540f8608f4fefe60b8eef544370522849a5e57a744de24d64c085ce11fde
SSDEEP

1536:9CC+yfE+4WgZ0fZb5zaZBi7KRclFqaGBofW2JB+f0/0RB+BnaXplFl06e6cEsDBu:Hgi5HfbYphqXN66u4U3J

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2480	msedge.exe
2480	msedge.exe
1808	msedge.exe
1808	msedge.exe
3628	identity_helper.exe
3628	identity_helper.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1596	1808	msedge.exe	85
PID 1808 wrote to memory of 1596	1808	msedge.exe	85
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 4904	1808	msedge.exe	86
PID 1808 wrote to memory of 2480	1808	msedge.exe	87
PID 1808 wrote to memory of 2480	1808	msedge.exe	87
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88
PID 1808 wrote to memory of 3600	1808	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fda15d23244083887a3273e0739f5825_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9806246f8,0x7ff980624708,0x7ff980624718
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,18234394870190401217,1302067575324380035,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,18234394870190401217,1302067575324380035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,18234394870190401217,1302067575324380035,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18234394870190401217,1302067575324380035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18234394870190401217,1302067575324380035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18234394870190401217,1302067575324380035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,18234394870190401217,1302067575324380035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,18234394870190401217,1302067575324380035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18234394870190401217,1302067575324380035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2616 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18234394870190401217,1302067575324380035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18234394870190401217,1302067575324380035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18234394870190401217,1302067575324380035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,18234394870190401217,1302067575324380035,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e36b219dcae7d32ec82cec3245512f80

SHA1
6b2bd46e4f6628d66f7ec4b5c399b8c9115a9466

SHA256
16bc6f47bbfbd4e54c3163dafe784486b72d0b78e6ea3593122edb338448a27b

SHA512
fc539c461d87141a180cf71bb6a636c75517e5e7226e76b71fd64e834dcacc88fcaaa92a9a00999bc0afc4fb93b7304b068000f14653c05ff03dd7baef3f225c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
559ff144c30d6a7102ec298fb7c261c4

SHA1
badecb08f9a6c849ce5b30c348156b45ac9120b9

SHA256
5444032cb994b90287c0262f2fba16f38e339073fd89aa3ab2592dfebc3e6f10

SHA512
3a45661fc29e312aa643a12447bffdab83128fe5124077a870090081af6aaa4cf0bd021889ab1df5cd40f44adb055b1394b31313515c2929f714824c89fd0f04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
988B

MD5
367706f68e2f0e4202ce026552c80bf4

SHA1
f86751849720cfe45f71e841e5dd0bbe7ac8780b

SHA256
2f9ece5a6b8900c65d5e245c7c98318b108dbb9684c59d3efc5719bc62452840

SHA512
3641fafdf73f85089251541de00bf4a91aedd510db4ed09d6b1d2ae59c2f1b56c2eae56b9453448a45cf1e4439b3426b7c95dade85f324e4c4fbfc18e3b98ffb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cee7bbcf13bd15460105c16a7d85a047

SHA1
4a2b557c0096525d489f58cb68e98938711d5d66

SHA256
93319d40485f6720c9ea666a71d3fbc513bab3314645c401345b369ca98b0964

SHA512
4705caf91891351b6976725e872951246117c414684c6b59b04e78e193a7defe882953e9f2d4c8440edcb7a8c372c1c83a9e79b83d9184c3926765e513412066

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7fa9ce332bd2593972348e57b14e85fd

SHA1
a09ea5a3f8937135d079448bfb531e766952e19a

SHA256
c6d9af7c1875bca208a5466550a89a997d90f8a5dc39d946dc466e5d31ca93e9

SHA512
670cf4ca33caebaded0b60f421954ed4d544bb1a26eb9772e354233142f8060a0c794c027c1620276ab86b9969c148b9b5a793f9ee4a94e3d5abb7f86ed43295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
481b9d82f613d940d99f763680dbcffa

SHA1
861112c6983972cce7b629db34f1191637cc1479

SHA256
fac0a7709f17eaf8fadda22f3a91490e80992eba77f27822981ffe9c5626a262

SHA512
87625e63aa9801f5abd46ce1b9a13e0b4730b9e5b3bb11834913574a391de185e407f01d0fb15d6b2cb1c4eface8def120012ec4bfaef3f82290fd0029030a1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6582e695ffe9c60654dff47dc4ce1777

SHA1
926be901f72f0da9531b7780b9d4f0999597136c

SHA256
e5b06bc359fbf03b7e3626676ed8272f8de680907324afe2cb5cca070e24b6f8

SHA512
1799e139965bd29d50e2c0f60bfe30899fc754d34d0c29298414ae14b6dd0ac30c20132f0250f30e321b175f5ba5e19392f606c166bfc3a7fe8379834473a764

Download Submit