ea87ac7eae7367855048ea00ccd1e8b3cbb90db85a27174a638cf793a7b681ff

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 21:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0629dfc63b9b0228e5e43f002bd33db0_JaffaCakes118.html
Size

201KB
MD5

0629dfc63b9b0228e5e43f002bd33db0
SHA1

ecf8c8d84e5097c63a05c357b36b30b5bbc88998
SHA256

ea87ac7eae7367855048ea00ccd1e8b3cbb90db85a27174a638cf793a7b681ff
SHA512

f9785491c192da12a70ef2d17386477f50c7c6d9c4a1a36f0882a169e7805e5a2209dd6e678f7ca7f5776e54370fb8f6af2cdee8a0733d87bb4fdaf99a04966f
SSDEEP

1536:47hD2uVvnaFz6n1AaULpBS2oqVUDDkNAib5e/6pBJ0+xzgF+JQKpWmdnNg/gPoFS:47h9Vvnmz6QpBvtm6NqgdnNLoFKpJenW

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
932	msedge.exe
932	msedge.exe
1248	identity_helper.exe
1248	identity_helper.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 5100	932	msedge.exe	85
PID 932 wrote to memory of 5100	932	msedge.exe	85
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 4940	932	msedge.exe	86
PID 932 wrote to memory of 2728	932	msedge.exe	87
PID 932 wrote to memory of 2728	932	msedge.exe	87
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88
PID 932 wrote to memory of 1252	932	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0629dfc63b9b0228e5e43f002bd33db0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa90e246f8,0x7ffa90e24708,0x7ffa90e24718
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,13687765128590547101,4281222203069090217,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,13687765128590547101,4281222203069090217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,13687765128590547101,4281222203069090217,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13687765128590547101,4281222203069090217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13687765128590547101,4281222203069090217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13687765128590547101,4281222203069090217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13687765128590547101,4281222203069090217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,13687765128590547101,4281222203069090217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,13687765128590547101,4281222203069090217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13687765128590547101,4281222203069090217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13687765128590547101,4281222203069090217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13687765128590547101,4281222203069090217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13687765128590547101,4281222203069090217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,13687765128590547101,4281222203069090217,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5652 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac599fdf17d85c66d65784fbb7070b25

SHA1
620eeddb1aef99ba3e5df8161b48f7f8844b0fb5

SHA256
3a07401551d1a3cb2b62cbb21c486c0836372806018de2caa7b4a1bbd990ecc7

SHA512
881920cf1f970967b89461d64382e70b564b8a7cf7ff60ae35b258a413ae0a4ce824cd56ee5cef6c8d02caa63016a3d11bf01bffe973f4caacbda6bcd7300a59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dc7d8ae98c7691f50e5cd794e6798aa0

SHA1
edeeb09cd6f04746366d0fc3008abb2010a0e58a

SHA256
df8b2a6b97e67ef71f01a70f7a6ad3da9b81a0eceec72ca8503d645faa777762

SHA512
a76f4b507b3d6966d1a5091d6b3fe648a0ba616cf759e836db7c50b7d809817dddb7ca14b53243fcf50aab448196136c68bb084c54d5d64dd9e06eae7b0383d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
2eea4192e63b4dd5e2d94b18e240a5e2

SHA1
9dc5420e6e8b3462b2460b62c9317b4c4fd677b6

SHA256
39123900af6db0c604b9d93baf97fca62da19dbd593e34dd5c7bd3a1be795b21

SHA512
50d4c79a65e8b60cccd0405f856ba45ab4b889fa101536b0b18078e3c17566f97e4ae6c35a39c4a5f43852bf98e3b8d9e98cb5e8dbd8f1dda14efb356d083884

Download Submit