54153a7ea7c14b783ec7ecfeb9aef9892a2f29b99e9bcfb9d94adf219ca21ba1

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0663b6d8726dc5584882f9009d4a0baf_JaffaCakes118.html
Size

39KB
MD5

0663b6d8726dc5584882f9009d4a0baf
SHA1

bdd3253ae9338f6a1dc1afd6e839bc84846ed1c5
SHA256

54153a7ea7c14b783ec7ecfeb9aef9892a2f29b99e9bcfb9d94adf219ca21ba1
SHA512

a88d7006b29b43e70a006ba92904947cce81ec27d80bc0bf08a3aa8240cbb2443356fa32964d2e671f2dc39c2a5313e49c2cabcf293ab00e862af464cb7591c7
SSDEEP

192:uwzyb5nrGnQjxn5Q/NlnQie2NnxnQOkEntTZRnQTbnc8nQmSUxWXAsuhtD55coWa:mQ/w3xsCtaiJ0O

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
384	msedge.exe
384	msedge.exe
1636	identity_helper.exe
1636	identity_helper.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 2288	384	msedge.exe	83
PID 384 wrote to memory of 2288	384	msedge.exe	83
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 2516	384	msedge.exe	84
PID 384 wrote to memory of 4620	384	msedge.exe	85
PID 384 wrote to memory of 4620	384	msedge.exe	85
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86
PID 384 wrote to memory of 3128	384	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0663b6d8726dc5584882f9009d4a0baf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdba2546f8,0x7ffdba254708,0x7ffdba254718
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,12871270959070366104,17099836547805299585,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,12871270959070366104,17099836547805299585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,12871270959070366104,17099836547805299585,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12871270959070366104,17099836547805299585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12871270959070366104,17099836547805299585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,12871270959070366104,17099836547805299585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,12871270959070366104,17099836547805299585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12871270959070366104,17099836547805299585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12871270959070366104,17099836547805299585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12871270959070366104,17099836547805299585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12871270959070366104,17099836547805299585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,12871270959070366104,17099836547805299585,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4528 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d570027f73f0718707d65823e8c22b80

SHA1
fdff57b7b34b9c5de22aa5200ddcd8e6942d04e9

SHA256
ee746b0fcf642f2ac3436c8ec6b223d4cbd64da5b3210d2f9bf5f3db0202dc7d

SHA512
f2131bad37236d0769100eba70dce00b4407d543ec8b75e4e3a8bc7377beba2c3703d8722d435b7c3b55d53cdc24d17fc770b694a36200ea42f2a9358b063cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cccca18ace095e7848347cbe883b6283

SHA1
1e3bced2ddc510500e366940ae6d5d44fdb0228c

SHA256
aa3e64109f3063766c7b110fe5fe1c7a34f3e74691fbafa9f62681b88dd47c69

SHA512
4c7369171f64ee6be23fc4f665f3584078e2d43eb3fa0c320b47312ae1140943995a0e36c1d0a66249806fb53888aa851be7124e023461ccc3e3f25a23749c69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
9682a435a157367fea34507f70eae27a

SHA1
60112ab7fb5c54897a515d8aa5c72d269530fb69

SHA256
6d2bd781de6e599a5897a68d553869f5627debc5ac9839dd6aed276584ab4d6b

SHA512
335a8d5d0913d134f4c5699a41dc6f0a1a39f9a8cb5372a99fc52e4b9bb76f84d0d23013e2bc634b0fb7aec5aeb600f428cda4383cfbd7387a7c5945f12fc4ed

Download Submit