4bcc198a55bf68fdad7be16e00f4e9dc71557d4255493d7d304787cfe0fa904e

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

039660e3fb86666d4ca5d7dece5cbc84_JaffaCakes118.html
Size

30KB
MD5

039660e3fb86666d4ca5d7dece5cbc84
SHA1

4cd5e0e49a58ad6050fc81af970da19e3bb4711b
SHA256

4bcc198a55bf68fdad7be16e00f4e9dc71557d4255493d7d304787cfe0fa904e
SHA512

b5752f8d46e36b718499047f24a65236cec4ba0565146902a697f6c4fbd41f94d21f13dabac46eaf29dd412d536bc9faf0ff281cca82fbc6ffc035363372cd6c
SSDEEP

384:EWGtjWCBNM5OiaeNRh7mJlzQ/z9K46RTcb7pxGt6Rh16VQ1NFWKj2jhj/lH8idaz:B2y

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
4764	msedge.exe
4764	msedge.exe
3904	identity_helper.exe
3904	identity_helper.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 2680	4764	msedge.exe	81
PID 4764 wrote to memory of 2680	4764	msedge.exe	81
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 224	4764	msedge.exe	83
PID 4764 wrote to memory of 216	4764	msedge.exe	84
PID 4764 wrote to memory of 216	4764	msedge.exe	84
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85
PID 4764 wrote to memory of 3128	4764	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\039660e3fb86666d4ca5d7dece5cbc84_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbdd3546f8,0x7ffbdd354708,0x7ffbdd354718
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16816554863886660505,8579574749096064548,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,16816554863886660505,8579574749096064548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,16816554863886660505,8579574749096064548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16816554863886660505,8579574749096064548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16816554863886660505,8579574749096064548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,16816554863886660505,8579574749096064548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,16816554863886660505,8579574749096064548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16816554863886660505,8579574749096064548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16816554863886660505,8579574749096064548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16816554863886660505,8579574749096064548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16816554863886660505,8579574749096064548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16816554863886660505,8579574749096064548,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5332 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ea3d5edd8ab8bcfd8d8c1063fa26d96

SHA1
aca7c5022e53ca4801495f674d71a02647143e0c

SHA256
7c6fc4258a51b07fd6b904e8dd0e80b7e7df6f47dcce56b624dcff80ce6e9eb7

SHA512
6f12571d35c8682ef2b60516852c9c9709f3f84f074b2a271b99d5f3bea02abaab88b013a1e099f7a45453c2d1642af558e39eb3a7f15ed22ff211bd01b10146

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e90b7826d935de8bdeddce9abf045bba

SHA1
128e5cfb74c4b52c39a62f3cd4f2410cbdd2915d

SHA256
3478c2debbabaf49587a4da6a42144307fe15d9afac451622488dba4d3a057a9

SHA512
b8bfd55e1f2b4724c9a1e4ffe08deefdb3f13e585bbe67c0d2f6f1b37c2b63d3e65b79d86b8f536786156d8e6d0de7a119f2064394959d5a435a667c1ba3b938

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c8f86e1a86b85a616e0df282f10b1c5a

SHA1
444fc78c84e559dad459d5cae94d8819630874d0

SHA256
451c483cfe47c00a58e729b13478cb3783aa1e44044d482ad4586d47e64e37ff

SHA512
541ba362ad10b2abf18b5b4c311ab5e9b8c2b3f768392e647db26b8d22983f234acd7d93a50d4f28d89031dac0855968645967ba82b574372614fcf3c885a961

Download Submit