0c7a93476e13c4c51ea8ecb9c45b9d107e9cde786b282f5bd4e09c4bde529a55

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

08b15362be6edd9f1129fb307a4d32c0_JaffaCakes118.html
Size

23KB
MD5

08b15362be6edd9f1129fb307a4d32c0
SHA1

405c3398960940a9c3cb25c8add17e1d86955089
SHA256

0c7a93476e13c4c51ea8ecb9c45b9d107e9cde786b282f5bd4e09c4bde529a55
SHA512

59261438b863f4ccfdf81b63733275b6d70fe7179081f5b499163a0f8b75a5caf92af0a16d9a3e1ccbae15f521cd2171e6a3a524bbc5360ef4f0015e85478897
SSDEEP

192:uWbMb5n3chQnQjxn5Q/LnQie6NnQnQOkEnt5tnQTbnZnQ4CnQtYwMBaqnYnQ7tn0:LQ/6H2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4392	msedge.exe
4392	msedge.exe
2864	identity_helper.exe
2864	identity_helper.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 1348	4392	msedge.exe	84
PID 4392 wrote to memory of 1348	4392	msedge.exe	84
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 3752	4392	msedge.exe	85
PID 4392 wrote to memory of 4568	4392	msedge.exe	86
PID 4392 wrote to memory of 4568	4392	msedge.exe	86
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87
PID 4392 wrote to memory of 5040	4392	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\08b15362be6edd9f1129fb307a4d32c0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd13c246f8,0x7ffd13c24708,0x7ffd13c24718
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5021527133904632356,8100706546760559308,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,5021527133904632356,8100706546760559308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,5021527133904632356,8100706546760559308,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5021527133904632356,8100706546760559308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5021527133904632356,8100706546760559308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,5021527133904632356,8100706546760559308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,5021527133904632356,8100706546760559308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5021527133904632356,8100706546760559308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2208 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5021527133904632356,8100706546760559308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5021527133904632356,8100706546760559308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5021527133904632356,8100706546760559308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5021527133904632356,8100706546760559308,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a20f8be91074215ac66cd2aaf22677e7

SHA1
71e5a1a2be7945deff17170a235ee0fa3d1f2bf4

SHA256
7a9d32f7f1440c124abe2d71182f32b65a0b80e9d307e05a82745434d6d1d98f

SHA512
d6cdf53cecdaed19d7b19477295586b640ffe522c4e57d1984b9fdb28938776e364acb85d1eee7fdba523669dbb57d91ca55141a1c6351d6791f9bab65571aaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc7819445b18705dd8b602fd9f27c336

SHA1
45c39781e2f48750250851f1010a81fea0a9db32

SHA256
5b7b5175a29f13984266c1eb9cd264413a5831062fc5b3333ff1bc6739ff5cc5

SHA512
39a78be2415ddba6a5d3b0dbf223ce8e22a9163374142b9198d59617c23c13f120794f176381442dd79629e2de9b767afc585db130d4d4a065a76587c1ef078e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
45607c4006a359af6d612671a56be949

SHA1
944c89d3a6acca572bbf34ea5c13da3303f07033

SHA256
543ea1d553bda9ca412163f6d1971678adc6f21ca95bba8a2792e0a50f9221fe

SHA512
61af0cfad344173d169000c2014789cb0376021aa74cc1f91551a4fe9add4fff12c303780562e079e69013be37e135af2ac2907812f3c406baecac15f47d31fd

Download Submit