4401b3a649186d144a1931719eba155369b997ee2ae632d29d67332a4a665208

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 09:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fefa7340107d36c1f3447745009aa375_JaffaCakes118.html
Size

1KB
MD5

fefa7340107d36c1f3447745009aa375
SHA1

bd2219dffd8dbd5479154790043310be094a1bad
SHA256

4401b3a649186d144a1931719eba155369b997ee2ae632d29d67332a4a665208
SHA512

8997950a47896fe87a3e17aadf387258a725c4d70f55961215efbb2ea61700f869c148c4faf7e4e33f6f051efb1ac6d9185e912049b82fdecfd6669bdd4d9c1c

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
1712	msedge.exe
1712	msedge.exe
3404	identity_helper.exe
3404	identity_helper.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 3640	1712	msedge.exe	84
PID 1712 wrote to memory of 3640	1712	msedge.exe	84
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 1616	1712	msedge.exe	85
PID 1712 wrote to memory of 2060	1712	msedge.exe	86
PID 1712 wrote to memory of 2060	1712	msedge.exe	86
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87
PID 1712 wrote to memory of 3996	1712	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fefa7340107d36c1f3447745009aa375_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6faf46f8,0x7ffc6faf4708,0x7ffc6faf4718
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,9139224975441435615,13483487624117645523,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,9139224975441435615,13483487624117645523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,9139224975441435615,13483487624117645523,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9139224975441435615,13483487624117645523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9139224975441435615,13483487624117645523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,9139224975441435615,13483487624117645523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,9139224975441435615,13483487624117645523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9139224975441435615,13483487624117645523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9139224975441435615,13483487624117645523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9139224975441435615,13483487624117645523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9139224975441435615,13483487624117645523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,9139224975441435615,13483487624117645523,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1288 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f38951143ede15b2f00d3352e458d47

SHA1
1130065985230474657d5f744e99312f22c69485

SHA256
3a559763ad1634ef40108700025a909cc76ca8c66d6c77f41a07e2ced4c9ff65

SHA512
5376e21235d1b828a0d04e35d26154a1e52db3fe02690fa272ba982da55b88bb0ab7473e6b2031fe8d19798abefec072e22542132b175912b31279cda6f15f57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b533661b945a612876de1e58ce73d065

SHA1
d93286945efeb7f33b49f8e594cdb264884c827e

SHA256
e5480b47432d7b0ca972afe477fac49f5fc1e8e82aaeab6401de99045949bd65

SHA512
672bc0f694e763a8597eebcce7728716a09515ad17854fae58d1f8df8aefca152eaabfd637bbaf8acae8e7936309809525a9f058a990148964a58c831d96dc4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8fe958c7dcdf50bf7ed0ca862e3ecd6e

SHA1
6c86af20ce6c094c67580664cd6472782badf3d3

SHA256
0b367476b4a910da6916f1af916a3ad327247c5a6926659706ec3bf71ec04432

SHA512
8ba34834e1afe1d5fb07e2b32e4fc8fa7d69127188917e1939994ca4d3778f532fb6f5b7a9d683e5d3fe1f5848a84c8eaf7306e324400f7f05a4206a868b2ede

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
27e7b40fda5762fcdce06714653c4506

SHA1
46d39a448153bd0bb969706da28881bda0593370

SHA256
45479df097feb3da46829f4c18a560d686c55be5b7fade44de7603509d0af708

SHA512
beaad7a7d0b3125ba766eedca59eb2bcb34e698570d3d24dfb6dabe908a2794e8b52eb1321711ecfcbc09531e2bc3cae05725c18ba2fea474ff6ddf10a22ab83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
eba8517f3652641367e901d3a54f7581

SHA1
fea9f4fd8d38fa53f21cebbc148d48fb07fe13c6

SHA256
2d7c268095e786a3e6c729a4503a10709df851a8899197637e6d42aa11fce388

SHA512
da857ea24ab0a1f4e1eae0a23c1b50e86c5e4c5781f9cff94eaa20127671ed5b1ed681c9b626366f155ec89e767ca11554a77f0f4c3a42c44cf821654b483517

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a9f84e5ffffbe0f1ecbeb3d593e7579d

SHA1
ca1a401a2e99117983715f56a36550546c9ab444

SHA256
1963fd6b31693fefb29e5fc1ffdafc849625680ebde64b63831798947a648fbf

SHA512
3605148870c86d3d632aadcc2e0be271afd2c7b24ea449ba86c07dc056effa52bfe029464dab5be0add2cd2844c19352ab989e76bec3905c8bcdacbe8166f37f

Download Submit