8aad52c438a14f78692e55cffb54f0614b4d940bcff2b84ec1484b9f568febc0

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0433c44e30675030056e10f0dccfb3f5_JaffaCakes118.html
Size

218KB
MD5

0433c44e30675030056e10f0dccfb3f5
SHA1

f46c2f1c9ef194f772eda7cde6e90487d235591c
SHA256

8aad52c438a14f78692e55cffb54f0614b4d940bcff2b84ec1484b9f568febc0
SHA512

454702a3706e8458b07e93a3c0215c348c5422d7ee9be22862c704aa06036191d4b61897816de59e78e2ac872fdf565f4c75206742465aafca78978d64e679dd
SSDEEP

3072:SnSAsiC5puDzyfkMY+BES09JXAnyrZalI+YQ:SnSGwSWsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
2996	msedge.exe
2996	msedge.exe
3428	identity_helper.exe
3428	identity_helper.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3876	2996	msedge.exe	86
PID 2996 wrote to memory of 3876	2996	msedge.exe	86
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 3136	2996	msedge.exe	87
PID 2996 wrote to memory of 5032	2996	msedge.exe	88
PID 2996 wrote to memory of 5032	2996	msedge.exe	88
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89
PID 2996 wrote to memory of 1972	2996	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0433c44e30675030056e10f0dccfb3f5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe317946f8,0x7ffe31794708,0x7ffe31794718
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,16287345145332534979,10893932495749182734,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,16287345145332534979,10893932495749182734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,16287345145332534979,10893932495749182734,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16287345145332534979,10893932495749182734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16287345145332534979,10893932495749182734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,16287345145332534979,10893932495749182734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,16287345145332534979,10893932495749182734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16287345145332534979,10893932495749182734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16287345145332534979,10893932495749182734,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16287345145332534979,10893932495749182734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16287345145332534979,10893932495749182734,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,16287345145332534979,10893932495749182734,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6744fc6923b2e3cf6c7f44c3088aec4b

SHA1
445981db607781d180e6a1813058c7982f4e80de

SHA256
27313870d42f035094189b6ae4322cc9287e16770f66653ba3c02896cac6c339

SHA512
3a03a896788a0126ecd2f48a200b077d77742205551aa33476336df0991b2a333feed00252d54714a9e7ceadb080c70f49e320b62e5b3d7dc099c96ab2e44f91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c1266f289e782f7e9ae675a2652794e8

SHA1
756632be3f78ae879dfe25878d09a7d8d8975bc2

SHA256
0337d15bc7a155aa553e14c2d9296b6f7dfce7ffa0da23855e3807262b3854e4

SHA512
8a0c36625af615940d050dec4f2bb6bc7fe506b20819f4bb1bacfbf36b02bbb52ea3effd8e17aa443b2a6134a38a4b49eae8519dc3ff2bad8f904f64890436ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
6662ed9432270aa0a34c87619a6d19a9

SHA1
c4b068c6d895a13605359137f8ec931265c2f437

SHA256
3b8b5131bc4529ccf6e4ac620b795b4dacf407550565fa77d17b07dbe3cf45b0

SHA512
8dc0fc53b6020e07929df816c77d4240e2927b7b7fb085d7c86912ce3c2c808e7771abd90890d5c47e1430f6ae2539c10b5a3c2caa99905f03015c8b42f999be

Download Submit