8d2b28fd5d3589d3c66c7a845665b0c9a09938f1f265694f3aa99bcd22a52022

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0649483fcff1f8b4600754c4933bfec4_JaffaCakes118.html
Size

4KB
MD5

0649483fcff1f8b4600754c4933bfec4
SHA1

0ddb8c537678439c5292ea794d3fa29475d414d0
SHA256

8d2b28fd5d3589d3c66c7a845665b0c9a09938f1f265694f3aa99bcd22a52022
SHA512

8ea9ae9b519c288a420d0d8dcf173ac91693daebd11f8bad77535f04855b2cbb82b77dfff18428cd37f8ea65e9c35d4d07a123ba7369dd057bd6627fed425e4c
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oyT2Dxd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDo

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1524	msedge.exe
1524	msedge.exe
4808	identity_helper.exe
4808	identity_helper.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 4768	1524	msedge.exe	83
PID 1524 wrote to memory of 4768	1524	msedge.exe	83
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 4512	1524	msedge.exe	85
PID 1524 wrote to memory of 1628	1524	msedge.exe	86
PID 1524 wrote to memory of 1628	1524	msedge.exe	86
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87
PID 1524 wrote to memory of 4524	1524	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0649483fcff1f8b4600754c4933bfec4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8a2246f8,0x7ffe8a224708,0x7ffe8a224718
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13547497717729038253,976079949583016807,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,13547497717729038253,976079949583016807,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,13547497717729038253,976079949583016807,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13547497717729038253,976079949583016807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13547497717729038253,976079949583016807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13547497717729038253,976079949583016807,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13547497717729038253,976079949583016807,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13547497717729038253,976079949583016807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13547497717729038253,976079949583016807,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13547497717729038253,976079949583016807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13547497717729038253,976079949583016807,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13547497717729038253,976079949583016807,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
0347602b87a2c759430ead2c8ceca6f8

SHA1
773e47a3ec5114ad14f090d3305c2c169d4776a5

SHA256
95334d11994d3b0d4fb8a1bb05baa0415275ee9b833df4bb47baa243e083b947

SHA512
ffbc5762314236210cba5ae73b830d2cfe10e967f6b57b8bd5de402dfc2668f7ba4003580018b4e648ec5523e7639ce7d7d1724a16ed481ba8d10e546e3b8d61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88e3fc5b188c4ac14c8328aa21dc13b8

SHA1
66dcba80423f0fb0b12f4a56b17acdb94614fcfc

SHA256
5850603643a820f67935cf2c23b3d42feae32dd6619cb33b1db97aa2be0ab41b

SHA512
204e6f5e9104ac6e453b2272c940df1de6f80e1cc89285a7cb1ac5a182009e72778ca950460345d213926763a3d2ff379d686239126227852416e411140e1237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b313ad98161664978ca656b1a54d39b

SHA1
989e93f81a05dc782e4a00040ed85634e05de61b

SHA256
c20b024b23eb2d129c3fbbfff0a538a33e5887980bf640633380f1a7443c0026

SHA512
af108fdc1ad0e2e13753555d30fb5982a8fd161b0be0ebd197ebb25ec5b7a9c45e872e6732c7a76a50812b4648d78691aa3b947ec5cac5a95d8f5b4444a02a61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
28fa839bd25b2dcce3d69d59b2a55afd

SHA1
47545a8eb9dad2dcf2573dd196d7e5999b7a6c4a

SHA256
bbada654347723b67ece8d556120b20b593eec025c61d841ec13e4424b653d21

SHA512
814c1c97b1b3d8bc872e135b370ee37f1c42a400dc2f06d3349677c10b2fd39124d38c1a9e04ac3570c5e09075e92f54bbbdc2dbd828cf5265a8df5a9c02d900

Download Submit