b8a7c83e8639dfcb235c3caacb27dc11db965cdab382054022c78dac1d79ebf2

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

049d929d25cf9fb2e5db41bc55166042_JaffaCakes118.html
Size

82KB
MD5

049d929d25cf9fb2e5db41bc55166042
SHA1

db11c54e43093ad87f5627f4b82b643bf176dd9d
SHA256

b8a7c83e8639dfcb235c3caacb27dc11db965cdab382054022c78dac1d79ebf2
SHA512

cfa3bdfa8b3b2ef1d901aba650146176ff1b67a8a01df545641f8bfaaffbd1c247e49cd119bf68540223d3ed51378b06e867fd2c198c024a5877742884147372
SSDEEP

1536:lR12AcZ7GLeUG6O2HFV00IzO9qhnAiK9RQscC76iol1eQSUYfLe4Oygp5yv7u9wY:0AcZ7dUG6O2HFV00f8hnAiK9RQscC76B

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4120	msedge.exe
4120	msedge.exe
3848	identity_helper.exe
3848	identity_helper.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 2612	4120	msedge.exe	83
PID 4120 wrote to memory of 2612	4120	msedge.exe	83
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 3344	4120	msedge.exe	85
PID 4120 wrote to memory of 4560	4120	msedge.exe	86
PID 4120 wrote to memory of 4560	4120	msedge.exe	86
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87
PID 4120 wrote to memory of 4980	4120	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\049d929d25cf9fb2e5db41bc55166042_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe875746f8,0x7ffe87574708,0x7ffe87574718
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,14926277743045830702,17522136830168901739,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2388 /prefetch:2
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,14926277743045830702,17522136830168901739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,14926277743045830702,17522136830168901739,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14926277743045830702,17522136830168901739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14926277743045830702,17522136830168901739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,14926277743045830702,17522136830168901739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,14926277743045830702,17522136830168901739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14926277743045830702,17522136830168901739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14926277743045830702,17522136830168901739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14926277743045830702,17522136830168901739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14926277743045830702,17522136830168901739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,14926277743045830702,17522136830168901739,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0ec66388-e0ec-42d3-a710-7bdfd0f73425.tmp

Filesize
11KB

MD5
99fa991f71f9e0d9a9b66635ffa444b2

SHA1
ca0086b9dce06d071f794d994d2661c6d4930732

SHA256
84aa7841184b8c00dbca78a240367d1d27ede7cb6fc6031ef7531508ff9fd45d

SHA512
520c1e20b95414a4e289aa07244cd3118bbb0e5b8fbda72c08e7279b1a8d01982e71bb7143cd212f0ba2ebd120abbbe6fd0f4c3cf78eb5a79162ef9ca11849cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3e2716b185bdd614ac651eb1ca8f5df2

SHA1
1646efebbb0b4f1e8ca3f7516b3450ebfde18779

SHA256
853d59c4ee5b0529832b6ab5e6bbfe5e7f8af00691c38e676f74e42d0e499b8d

SHA512
2ae6501b71bff4ebe034d3dd0177f0ff63dc46558cfbe252af31782a9b9d88548174ea0f04e4d8bb364706786afeeb93d0cfa065083cfdd770c8f9f0c0fbbc3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0744dec6d215aa7a01a646a9c7215533

SHA1
536f79e8eeff9db2bafa27d3bfe8d42881607ffe

SHA256
88c90d594c17e04f5b544768d28a8e889d80569d547b7a5cc2a1cb0baf9b32a0

SHA512
7ca0862f447882eef116e1dc12be4e2af049e40b281fe84160b160c83729fb924336e646022fc69b77a23aa72c566be19e86390401478efcc241f25d274b2f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b40cd445459e3a8aa81a4a2c40d8ad43

SHA1
32470f0fb680b1a497416081966698e2145b777d

SHA256
28749abac6be29ef31adb508c0dcdbd62646abaa03a5abf331e616b490f2bb41

SHA512
21835c0dbe5cf43716d3b75cada291a5f262f60f7e6aa1d64fd4bb3a1e30394c26c215336249d324a4d39faa60ce1a93ef8977c238bc386cdb5f12ff8f6065eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit