8c85e349bbd6b19072835a7bee84009337a49b0a293146104a0a5243a6230c70

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01ff83f9e78d150a7f3e7f70191193e4_JaffaCakes118.html
Size

110KB
MD5

01ff83f9e78d150a7f3e7f70191193e4
SHA1

11adcb0138cea20ce593eb39eb8f5fb544bd836c
SHA256

8c85e349bbd6b19072835a7bee84009337a49b0a293146104a0a5243a6230c70
SHA512

ca8a02dc22d3c337c3652c3be856e51d7077273be7180f7b5d700cb6a27917b75f865398eab8fe278b68f74f498f2d312a22c8a5c627dc20fe82c1ff50a53a82
SSDEEP

3072:AM9rCX7CeTsPqRcVhIVs2LQezvj40MZEPjLpUxAfYxslxNcl8CLcXmNRSxZkN+l0:pocijXmNRl

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
4928	msedge.exe
4928	msedge.exe
4504	identity_helper.exe
4504	identity_helper.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 388	4928	msedge.exe	83
PID 4928 wrote to memory of 388	4928	msedge.exe	83
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 4860	4928	msedge.exe	84
PID 4928 wrote to memory of 1508	4928	msedge.exe	85
PID 4928 wrote to memory of 1508	4928	msedge.exe	85
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86
PID 4928 wrote to memory of 3740	4928	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\01ff83f9e78d150a7f3e7f70191193e4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb2cd46f8,0x7ffdb2cd4708,0x7ffdb2cd4718
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,7279631517162272682,1295848395135707620,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,7279631517162272682,1295848395135707620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,7279631517162272682,1295848395135707620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7279631517162272682,1295848395135707620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7279631517162272682,1295848395135707620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7279631517162272682,1295848395135707620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,7279631517162272682,1295848395135707620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,7279631517162272682,1295848395135707620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7279631517162272682,1295848395135707620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7279631517162272682,1295848395135707620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7279631517162272682,1295848395135707620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7279631517162272682,1295848395135707620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,7279631517162272682,1295848395135707620,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4428 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f06e21f5545d701004680b4f80e2a6a0

SHA1
9426d6520aeca0dd284df695ad5f40010a2d6b18

SHA256
adfa27dfee9127a455f5c9ad4ec3738e707cff03827de519fde845a471df20f8

SHA512
5c91689992792d39403234a84a9dedcd9698144441a6e57e1467e93bd93f863cfad9ae6f18a9d8d332b61a548f932e8dcd30d561757bb21dd0a9192e8b17c457

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e29cc0adeda32458dde0dca9981ae7e4

SHA1
a37f1c7b36ce28e176865bb2a7d4460076cdd179

SHA256
791f057f31f97d4095e424b89a8d0a4900fc9dffd8260022307f8505a834006f

SHA512
f14ea96eda1c24b0109e6098e67e309f8403e077e73b0a1803e2ea48790172b394358f086965d90c4cbd8fd0d43e4ccfcb6eca977844e9f2ec778496a1d4468a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
44f6c2769937adf2a1f0d6eaae53d1d3

SHA1
79376d07ac8001fbe6f63131c66a2b0abcd62082

SHA256
cbc38193e00e70734baf1deca1d26d6aa57d2861a21c220436ccc926e34c5d24

SHA512
18c24ee6ffe0ed43c686415e14e01bf0184de27351f965bdd6fa3f3e467e38f4547c8b2c8fb9d02ffc7d9a87a9a76947c79c0be1de73347bc7e8d73c76cb79b6

Download Submit