a0477f9a50befe92f912c64c9f5b68f2e2300b8fe7dd61596ea62a0ae12524b8

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08a887f3b547d0a47b6021cc2190bc84_JaffaCakes118.html
Size

30KB
MD5

08a887f3b547d0a47b6021cc2190bc84
SHA1

b22673364184b2503876e01c52a393e882a82aff
SHA256

a0477f9a50befe92f912c64c9f5b68f2e2300b8fe7dd61596ea62a0ae12524b8
SHA512

711a1931f3151b4ef13975168d1d880362ef5743e0d43e31ad9992d533dd6c17203ad781f2631f2de48f29fd57020a04904babde3414715ec96cd57e21a64a3a
SSDEEP

768:Ci9XIxTNz4svErEXERE4EyEpEPEbEnEf1P:Ci9Xaxz4rQ0+NfmcAEJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
1160	msedge.exe
1160	msedge.exe
4240	identity_helper.exe
4240	identity_helper.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 3596	1160	msedge.exe	84
PID 1160 wrote to memory of 3596	1160	msedge.exe	84
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4952	1160	msedge.exe	85
PID 1160 wrote to memory of 4832	1160	msedge.exe	86
PID 1160 wrote to memory of 4832	1160	msedge.exe	86
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87
PID 1160 wrote to memory of 396	1160	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\08a887f3b547d0a47b6021cc2190bc84_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd1bc46f8,0x7ffcd1bc4708,0x7ffcd1bc4718
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,18247093076026436498,10723850677786209058,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,18247093076026436498,10723850677786209058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,18247093076026436498,10723850677786209058,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18247093076026436498,10723850677786209058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18247093076026436498,10723850677786209058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,18247093076026436498,10723850677786209058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,18247093076026436498,10723850677786209058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18247093076026436498,10723850677786209058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18247093076026436498,10723850677786209058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18247093076026436498,10723850677786209058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18247093076026436498,10723850677786209058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,18247093076026436498,10723850677786209058,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1112d0f85c26c69fc96ae08ef0e6c945

SHA1
902979496c3062ac2be6d8e717c902540c80d591

SHA256
1219d56f4445275367cff896ba22163b6e08f8b639dc1b4845596db3d873ef81

SHA512
9f87bd60f9c23e9bf47240c9b8149abe6c5d701263d7753215d04dcc742fe1825c2ed2acc2c15ed636d457c38169c6186982f7663a4df94b400a9eb1da88dd8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3cd40e81917cb30cd5ee3ac5243417df

SHA1
792a3aecae4b073d5f000fad23f35fa88fcc5cbd

SHA256
fc1e49d11e422e9867b7234536e41afbd0938e503d700eee65f0bcd49419070c

SHA512
ca1975ecd634249e2185002ca82b3838b3ad6525886f631139dee1a4fcd37308c1f4beb01420cbc358c4fe4f11a43ced5224c1932e12058b371f7be195d16911

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
c657394920a15019f71bac3a764ce268

SHA1
d6017e6a8e4e41763df18825123e5e684747b1de

SHA256
b0d11459213a9c5964208fddc1c064c1df1bbab731011dd4db98dee351dbd813

SHA512
6cf1e641d4515b4278d3b8bfb237f38937375733be4f4ac3d9c12b948470c2fa32bb95077c8535c0d9d255e3d03b037680ecaf86a8497fcdd0724fda6eb6543d

Download Submit