5cb695422c4717a5e3f7139a16a17d739457a5dbec9388e4c72c8430c387ab34

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

034324cf72c136f2adc61b934105c663_JaffaCakes118.html
Size

84KB
MD5

034324cf72c136f2adc61b934105c663
SHA1

54902e93b9c568004d1278b9fbc38e23575d150d
SHA256

5cb695422c4717a5e3f7139a16a17d739457a5dbec9388e4c72c8430c387ab34
SHA512

2ec4f0ab2de408f2dd6fb0827b0e6a334d8c2162a3a3d31434e4e263ebd9e03f83a7d27561bd48ee83d02dbe8f18ce58edd41ce86c773122be07c77d68b36aa2
SSDEEP

1536:b9fHY4Pm/iVgfLmLJgYZ+rPJInsKj7bdCPUcHRV+IBNxf4J4x4e4t4t4b4b4s4NR:b9fHY4Pm/iVgfLmLJgYZ+rPJsj7bLcHC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
4788	msedge.exe
4788	msedge.exe
3228	identity_helper.exe
3228	identity_helper.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 3236	4788	msedge.exe	81
PID 4788 wrote to memory of 3236	4788	msedge.exe	81
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 396	4788	msedge.exe	82
PID 4788 wrote to memory of 3808	4788	msedge.exe	83
PID 4788 wrote to memory of 3808	4788	msedge.exe	83
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84
PID 4788 wrote to memory of 5052	4788	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\034324cf72c136f2adc61b934105c663_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8b8946f8,0x7ffc8b894708,0x7ffc8b894718
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,9124668816292665754,11631211495950310301,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,9124668816292665754,11631211495950310301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,9124668816292665754,11631211495950310301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9124668816292665754,11631211495950310301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9124668816292665754,11631211495950310301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9124668816292665754,11631211495950310301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,9124668816292665754,11631211495950310301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,9124668816292665754,11631211495950310301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9124668816292665754,11631211495950310301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9124668816292665754,11631211495950310301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9124668816292665754,11631211495950310301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9124668816292665754,11631211495950310301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,9124668816292665754,11631211495950310301,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
568fde8480231159453badef7eb886f2

SHA1
c4afc6e1e35d40290e9ba860b948d54342c77261

SHA256
f45f2e4d6385c7aefeb1a122bc3a559b4111760e88162a9b9c38a419a0e4fcc2

SHA512
483ec5879718c82062a88db1134d68298e65b99f2729fd263824b62972b0cf8d89ab25736b6e990a97008716fd68d0ed9842f36348369fcd09d851667868fec5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dac575e4c877cb3e7aeb648634388740

SHA1
be65b3f9c79dd84802a52da40b07b6f374c3e7ad

SHA256
6e5438688cd9552ba2ace750d395a93fd62a2684a53bc8c6329048fc3693b028

SHA512
8fac2f4a55a2b797108efa9ebdb6b7dc867f61368067431ffcae82ecf77b7356aa3513efd4084e70257d4d7d1652bc5b02b678069d670cfa8c6c25b2fc14a838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac2d3ce7b3f4ec83f14bbd34194d96ae

SHA1
8f039eb6739ed1ce330d46d19c44032f5f394e14

SHA256
bf955cfbc9963a311e70f432372429cc1c4eb4039d442beac93e7462cfc3d2ae

SHA512
97f2358116b968cee83467363f025e1bdbc714aca8186f24008f66f5e2c5eee119d3ea7d5db6a9f62f42acc5a342d89d9e65287c75166fac2aba0cbf87a538cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2951f3249db51abfeaafbe7c8654d8fa

SHA1
7b153d8792a4ea335861eedf445c075ab7e78103

SHA256
f8f2ceb45695d95e6b3e47ef9cade583ff2d0ae276222222c8a55df4c9527495

SHA512
0dd7f172caf091a82e7133a0f207e496e0d1dc4e34590939516d5c1a149584d92259b59b9c97c0f66bb1c1bca27d9f62fe3b586e71c83f79be113e84fd2df719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
56dc8268ee4d0147d76ff0a450951f15

SHA1
9bdc09b8023934b7a2a1ac8effeb1c9054ddae7d

SHA256
20b5c93061fb6f79d2078610c6eb13fcc6c5ec33c0b610dfbb0e3f8dd3bc4dfb

SHA512
9c15b36b0d6d8f472377fccad5a2b50c5ed3d07be89704ae21673b9d2e89990cf8a56a2388ea8c7fa2febc751e8fd113d07c84d3791dac589a09391a08aec7cd

Download Submit