c22c4bfaf6a472f2423534ce5951386cd53658cbdd5db1d77805dc3f9cb33ea7

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09a6ad9b896735eac2d4019c82f055f9_JaffaCakes118.html
Size

139KB
MD5

09a6ad9b896735eac2d4019c82f055f9
SHA1

4b1bbf7971dc17781be5ae569e9eb2d8858a3779
SHA256

c22c4bfaf6a472f2423534ce5951386cd53658cbdd5db1d77805dc3f9cb33ea7
SHA512

ecedab4128978c76321a0ccdf4986f0df753a140e64f4aed20d49b3b3a76961e0ea2f79179fe26a65beaabf626a04073a8e84f1a8032c37821dc791c0ff20a2a
SSDEEP

1536:STxzmkBdEPlZ+yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:STxaoW+yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5200	msedge.exe
5200	msedge.exe
4224	msedge.exe
4224	msedge.exe
3656	identity_helper.exe
3656	identity_helper.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 1904	4224	msedge.exe	85
PID 4224 wrote to memory of 1904	4224	msedge.exe	85
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 2152	4224	msedge.exe	86
PID 4224 wrote to memory of 5200	4224	msedge.exe	87
PID 4224 wrote to memory of 5200	4224	msedge.exe	87
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88
PID 4224 wrote to memory of 5324	4224	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\09a6ad9b896735eac2d4019c82f055f9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1f3b46f8,0x7ffa1f3b4708,0x7ffa1f3b4718
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,10516321181284143993,9947255764663308521,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,10516321181284143993,9947255764663308521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,10516321181284143993,9947255764663308521,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10516321181284143993,9947255764663308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10516321181284143993,9947255764663308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,10516321181284143993,9947255764663308521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,10516321181284143993,9947255764663308521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10516321181284143993,9947255764663308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10516321181284143993,9947255764663308521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10516321181284143993,9947255764663308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10516321181284143993,9947255764663308521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,10516321181284143993,9947255764663308521,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
27ecd2f1130aec5619998816cadacc79

SHA1
a48e57ed9e429b271cd33541d0783231cf906f35

SHA256
a5cfb5c8c9f78e85e65defc26838988027b8438f6f3f8ef58824a885df4487c8

SHA512
e0fbc38fcb9d1a6d991325f25179cca603c80e74b4aedfaeda38fd141e3c7d7fad329f4883167dbcaeb28264d333e4ca2f98de48e1fa0c9c80ce7e9bc196f730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5887030525e29c27bc9a10e4f6a0f418

SHA1
62026d21115122fc7a6ec5039d4b203a62632dec

SHA256
0ecb30d560e0235f1c0f9544330e898289fa5c9370dfbdb94a3af051ca0192e5

SHA512
82d8e6dfe92cf980b5f123d84fc6d194b969b3b358cc46888210a27318e38ba9d9ca32f3d2a194ad2b9927a4238ce0c8b342c7a12179c69ce6629c06fcd3e8f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
b9f5a95bca5d23aa6ce04706fd1cf41c

SHA1
c51f5ad6ced1d0317c585b1cb41ba71c55a0e936

SHA256
53ef610e6e890fd0724d7293d64ac0b40584fded6d77f5377121eea00a70620e

SHA512
dcc75139499afe52684061b9c73681bc1fed475f08c9128abd0d31f3173fb52a581d3be6e26901ff90c8d5a593bf93a4960bf3a06b505c8becb79602dba8f244

Download Submit