777f7abc9853b3c69cd397e9caa88f0f9f2662a13030b12c8bce9068d6798dc2

Analysis

max time kernel
146s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 13:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

09da4834d69601f0df65e697389e0b53_JaffaCakes118.html
Size

15KB
MD5

09da4834d69601f0df65e697389e0b53
SHA1

ea1e6e72aa87148f7b66ce68cf330561e0f628d5
SHA256

777f7abc9853b3c69cd397e9caa88f0f9f2662a13030b12c8bce9068d6798dc2
SHA512

e9e6fb8a23684e2b05a2c4711201ec9b022ae8662f0264adec22493010c2639bc5aea672ccd03d4e6604389ce9fb5057bc6fe4fe248777d35df970f0e9154845
SSDEEP

192:Nz50ze80VhrXL95x2G+xYHqSMVdKGWMC2cUSDT4yiWXJcrpRYlP1T9CUCKgfyEE2:NjlVhrXLnLgVfB9U9rRu8TrSn

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
4028	msedge.exe
4028	msedge.exe
4516	identity_helper.exe
4516	identity_helper.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 452	4028	msedge.exe	83
PID 4028 wrote to memory of 452	4028	msedge.exe	83
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 980	4028	msedge.exe	84
PID 4028 wrote to memory of 2040	4028	msedge.exe	85
PID 4028 wrote to memory of 2040	4028	msedge.exe	85
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86
PID 4028 wrote to memory of 4956	4028	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\09da4834d69601f0df65e697389e0b53_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ef2346f8,0x7ff9ef234708,0x7ff9ef234718
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,11671263932859962279,7093588092723153773,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,11671263932859962279,7093588092723153773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,11671263932859962279,7093588092723153773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11671263932859962279,7093588092723153773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11671263932859962279,7093588092723153773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11671263932859962279,7093588092723153773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1744 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,11671263932859962279,7093588092723153773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,11671263932859962279,7093588092723153773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11671263932859962279,7093588092723153773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11671263932859962279,7093588092723153773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11671263932859962279,7093588092723153773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11671263932859962279,7093588092723153773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,11671263932859962279,7093588092723153773,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5536 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9dc60aef38e7832217e7fa02d6f0d9f6

SHA1
4f8539dc7d5739b36fe976a932338f459d066db6

SHA256
8a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32

SHA512
18371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7ac03b15b68af2d5cb5c8063057cc83e

SHA1
9b2d4db737f57322ff5c4bbddd765b3177f930ab

SHA256
b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700

SHA512
a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2cfe140f-c914-4287-983e-28de1f2c2ce0.tmp

Filesize
6KB

MD5
ad77fe3027acbeaaae89c0e9159d1141

SHA1
63e719dde2c6c7229d81ae5fbc742270579b452f

SHA256
fa277a0d9f33271f72ca8d0bf96703b2cc301b2518409a6866e55ddc0e1de611

SHA512
a573d735a9c8cc9db8ac90cd35acf8ce0fafe0ef7bf5cab16177e7fc2fc5e8829d8ba12e5e33bccb668cbcc6bd72bceba05794dc03e5757b26baf9e61d509826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3b7d9ad661eb92b1792d07a9b99113ec

SHA1
85afae09bd794b6cbd465a5e57719cf6dcf373de

SHA256
709d7c2d88882aa91f801d52310db080ca7e2a3011ff16083d6db536c6d49166

SHA512
22df8089b506c019d63b1e6f38dadf39f4a47c24a76d8c376aa2e9ded6548092fb7c7ea6e15fb2410b533f27de703911ae0da2b23b117cebad6998da0dd10f68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
904B

MD5
71daf35c79be4985778400c3592bf9bc

SHA1
ae837b2fb609c1c74b4cecc87be768f953f44623

SHA256
bdeaa632a31896b3088d4541c322050bbf64b1bde4827437da12e20f201406b4

SHA512
dcd09b868aa64669cf1167840e4d82beb759760a4915abe338a07e3aeb0081c32b9d9b9baf00922f50a38b223d563a2ce73995c58d1a9f9d1b955b3effe8391c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a22523245d9d47a5f641cf30c72e11af

SHA1
b5a79325981f4c1d4b2775ef4bc602b57f76259a

SHA256
9d45438f733bd85daac60e6338f2b4be6a7f3a4e89e9fda7a04a443c2e0a6646

SHA512
46acf54aefc7eb33fabb987c779073ee5b1d0ca2a177bf633371818d187617d5829e92608dfe760af55234245f8c6aee2f955cc65fef85008184005e6e398643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2158c99e7d808556198d96165a654445

SHA1
84083f63a273a9f09330460fd1d706fbed9a4c2b

SHA256
03f7c42ca4e5120b069f86330e4af649250f5b6a7ce776b7332815bc3572b846

SHA512
bb64256a03ab5b6f3cca61daf1b0375d052ceae9171a527c3dd70e464c08d2968e14212c65492542707585abb4de394abfbbcb39d8ed35365a7f131de26cfd36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
6bf949567ad6088267932d106a21c68f

SHA1
fcaec4743c1ad9b49237d4d2b7dbc3c52ed71edc

SHA256
33155ddc893d26b4934fe66fa71cd056d93b2d00cd07bcbca4bb2549bcc05878

SHA512
5422bdf01cb3f54a813d36e275e1660caff86ed742861ab3a045dc4d5652d01f65fcc3040e1d30017a590138ca97b2e2988fa48d2062700074b2b29fd8a67ab1

Download Submit