ee3328e7524ba42e591f29f3e0c8af092e8ad036c415dab1c425e8b7cd6ea123

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 12:47 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07b3337f1e364d787f8861ec78375b55_JaffaCakes118.html
Size

462KB
MD5

07b3337f1e364d787f8861ec78375b55
SHA1

34daf88d3a607e9380c280bae4eff73083cb4a51
SHA256

ee3328e7524ba42e591f29f3e0c8af092e8ad036c415dab1c425e8b7cd6ea123
SHA512

b32171558fd8e067bee4aea02bff1ba7dabcdc2dbe03ed565eeca0e892e736a77055841524cf8d627d8c150024173abb5c601047f40599b75c2090c57c5519c5
SSDEEP

6144:SssMYod+X3oI+YrsMYod+X3oI+YIsMYod+X3oI+YLsMYod+X3oI+YQ:X5d+X3J5d+X3I5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
112	msedge.exe
112	msedge.exe
4056	identity_helper.exe
4056	identity_helper.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 4328	112	msedge.exe	83
PID 112 wrote to memory of 4328	112	msedge.exe	83
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 4500	112	msedge.exe	84
PID 112 wrote to memory of 2268	112	msedge.exe	85
PID 112 wrote to memory of 2268	112	msedge.exe	85
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86
PID 112 wrote to memory of 4232	112	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\07b3337f1e364d787f8861ec78375b55_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa98e546f8,0x7ffa98e54708,0x7ffa98e54718
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,18397087907431296377,9460050722331018671,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,18397087907431296377,9460050722331018671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,18397087907431296377,9460050722331018671,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18397087907431296377,9460050722331018671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18397087907431296377,9460050722331018671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,18397087907431296377,9460050722331018671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,18397087907431296377,9460050722331018671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18397087907431296377,9460050722331018671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18397087907431296377,9460050722331018671,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18397087907431296377,9460050722331018671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18397087907431296377,9460050722331018671,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,18397087907431296377,9460050722331018671,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1580 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4280

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR
DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR
DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR
DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR
DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR
DNS

ag8aq.cn

msedge.exe

Remote address:

8.8.8.8:53

Request

ag8aq.cn

IN A
DNS

ag8aq.cn

msedge.exe

Remote address:

8.8.8.8:53

Request

ag8aq.cn

IN A
DNS

ag8aq.cn

msedge.exe

Remote address:

8.8.8.8:53

Request

ag8aq.cn

IN A
DNS

ag8aq.cn

msedge.exe

Remote address:

8.8.8.8:53

Request

ag8aq.cn

IN A
DNS

ag8aq.cn

msedge.exe

Remote address:

8.8.8.8:53

Request

ag8aq.cn

IN A
DNS

g.bing.com

Remote address:

8.8.8.8:53

Request

g.bing.com

IN A
DNS

g.bing.com

Remote address:

8.8.8.8:53

Request

g.bing.com

IN A
DNS

g.bing.com

Remote address:

8.8.8.8:53

Request

g.bing.com

IN A
DNS

g.bing.com

Remote address:

8.8.8.8:53

Request

g.bing.com

IN A
DNS

g.bing.com

Remote address:

8.8.8.8:53

Request

g.bing.com

IN A

No results found

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

330 B
5

DNS Request

8.8.8.8.in-addr.arpa

DNS Request

8.8.8.8.in-addr.arpa

DNS Request

8.8.8.8.in-addr.arpa

DNS Request

8.8.8.8.in-addr.arpa

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

ag8aq.cn

dns

msedge.exe

270 B
5

DNS Request

ag8aq.cn

DNS Request

ag8aq.cn

DNS Request

ag8aq.cn

DNS Request

ag8aq.cn

DNS Request

ag8aq.cn
8.8.8.8:53

g.bing.com

dns

280 B
5

DNS Request

g.bing.com

DNS Request

g.bing.com

DNS Request

g.bing.com

DNS Request

g.bing.com

DNS Request

g.bing.com
224.0.0.251:5353

msedge.exe

562 B
9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5e6a3d5eced6854a36916554798baddb

SHA1
baaf6e96cd6070c46efc6327150c76ffa8a8b484

SHA256
d3fa591bd2249dfcef720323f0724f644dd433492aab4960644e0d51a1389cca

SHA512
735e8b61561588b5d5c7a7e8f85f6177435475685ad3482d96509c3d43939f65c3ec13a47d95c4fdd527051ea8aa178c82de8f3c75e19395175b463fe7141d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
18c46fbf8562a0b4573e7c04554540b1

SHA1
1782679c225eab51595c984439d65130575c8b16

SHA256
355d840303d2dd1e6d355fa1a0893e99d07821df6867caed5ecd96f2ef2b2274

SHA512
325b5e076370430c806f486c912d0df82ecfb44da6b8b026fb0e819d3691f82a553478278cb8a490641b8557b317b181a0e15839e111045967e33a9178ecdeae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
5bceb5cec784bb10f9278348065a73c4

SHA1
59bac3a2fe7f7fae708d63d23fcfb4a099c98835

SHA256
b9f79e1da65f1b9a4ea323ef6c20bb049d723abdb84594c446d40a17bdd50a0a

SHA512
dac175e200c05d644f749b144ea0a922f3b6d71cbae3559ec5ee2dc6da364b4f9eeab3c7f9e52312fff16d8632746d5140614e34aa518395a0e2d1f82b13ab58

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.