d08c2d73ad07247f5cca8c3405c93897a70e5ad1f1259856562007a702092ae3

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04104653dec749e67170d3fc368e4456_JaffaCakes118.html
Size

50KB
MD5

04104653dec749e67170d3fc368e4456
SHA1

2d4e22d3fc6878a151ffaf072614a8585ca83049
SHA256

d08c2d73ad07247f5cca8c3405c93897a70e5ad1f1259856562007a702092ae3
SHA512

01ef42b987f48f130edf616e1f0e09db01dcfd16b1d82147988cf9194bcd6b4c48b8fed00a5947d8a5596fa6129ab69cbf1b5f1c7216de702c2907cb61f8f65f
SSDEEP

1536:GEijZeqL2EijZeqLds4AdJZSae4K9QclmZU2:GEijZeqL2EijZeqLC5dvSPKclT2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3676	msedge.exe
3676	msedge.exe
1892	msedge.exe
1892	msedge.exe
3420	identity_helper.exe
3420	identity_helper.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1408	1892	msedge.exe	84
PID 1892 wrote to memory of 1408	1892	msedge.exe	84
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 1800	1892	msedge.exe	85
PID 1892 wrote to memory of 3676	1892	msedge.exe	86
PID 1892 wrote to memory of 3676	1892	msedge.exe	86
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87
PID 1892 wrote to memory of 1008	1892	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\04104653dec749e67170d3fc368e4456_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac3a046f8,0x7ffac3a04708,0x7ffac3a04718
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,93608958923451247,16896718187744037115,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,93608958923451247,16896718187744037115,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,93608958923451247,16896718187744037115,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,93608958923451247,16896718187744037115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,93608958923451247,16896718187744037115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,93608958923451247,16896718187744037115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2548 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,93608958923451247,16896718187744037115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,93608958923451247,16896718187744037115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,93608958923451247,16896718187744037115,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,93608958923451247,16896718187744037115,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,93608958923451247,16896718187744037115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,93608958923451247,16896718187744037115,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,93608958923451247,16896718187744037115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,93608958923451247,16896718187744037115,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,93608958923451247,16896718187744037115,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1d4da09f03130df91a8709309e101d22

SHA1
a52012ceceaf830d69e0912bacbc3684d11882eb

SHA256
28b7ce0a635b3df914b33a74d945fd1aebf8dfa7185fce1119b3d7a862e7ab5c

SHA512
5f5761301a224bcffd6a9882a0f5f3b0c05327cd46b2a2fdbb2dd4c72a01d2a735ae5eacb3b2de96e87228d38f463f7fa120a3355e7b39059cadd6a8218aa8f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
545f09c44c6c8a1483cd90751bd6b981

SHA1
ee2b73c0219db4ecda0b40d598cfc1c9dda13455

SHA256
f695f5a49e06f74e5bb8abd6859b850baf3ef2dcebc668eb0e51bcd5e3b84510

SHA512
b8129af2f193483f7f9fc9fe4e1310f54b8e007749cf63bd0990c32e74e7bb39d3cf991b550c03dee81319c528d97ee36383bac8f47b6039b13eece41653656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
ab09c4c0846132007a2c75707164fb73

SHA1
afe4fd0e5d04fdb8cf33c0659d0b93a9fbb82847

SHA256
eaa0e88ea6b92a187531f6e39e1fd14a4c98f7c412bcba2e7084310447bb1625

SHA512
b0491f35851f7542670ec56d206b4cea25a21ba3464922b3d4035d6ec93250a46639f495730b1dd08f506d90e1acfbd3b23cfb83e486a6bc46391f483b0cb616

Download Submit