22353b851adf236e46d256cd8def993c376266f22facaa04483deb5920dbbc14

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 09:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b754382c7b73cabb7f21d367bd688c8_JaffaCakes118.html
Size

72KB
MD5

0b754382c7b73cabb7f21d367bd688c8
SHA1

31da963210ed8a299d291ae2dbf90bae0b51f35c
SHA256

22353b851adf236e46d256cd8def993c376266f22facaa04483deb5920dbbc14
SHA512

64b7e0fdddc31d10fd7048882976d52522a679475d3e3fd6ccec3162c3c98d2dc6439f283012bae78b5d165168c77dfdd1d65f653cb8a6914509f36221502164
SSDEEP

1536:RE2GDNdewcwrB3ohubycHRb3yltjKwXPPxkb4NHpdH5wcwNNdY2GobaQyDTMH4vB:m3ohubycHRzyltjK0PPXNHpdqalG4v97

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1992	msedge.exe
1992	msedge.exe
3384	msedge.exe
3384	msedge.exe
3108	identity_helper.exe
3108	identity_helper.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 2452	3384	msedge.exe	82
PID 3384 wrote to memory of 2452	3384	msedge.exe	82
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 5072	3384	msedge.exe	83
PID 3384 wrote to memory of 1992	3384	msedge.exe	84
PID 3384 wrote to memory of 1992	3384	msedge.exe	84
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85
PID 3384 wrote to memory of 848	3384	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0b754382c7b73cabb7f21d367bd688c8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffadc1246f8,0x7ffadc124708,0x7ffadc124718
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,5525677985896507224,1541683652081709242,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,5525677985896507224,1541683652081709242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,5525677985896507224,1541683652081709242,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5525677985896507224,1541683652081709242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5525677985896507224,1541683652081709242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5525677985896507224,1541683652081709242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5525677985896507224,1541683652081709242,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,5525677985896507224,1541683652081709242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3300 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,5525677985896507224,1541683652081709242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5525677985896507224,1541683652081709242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5525677985896507224,1541683652081709242,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,5525677985896507224,1541683652081709242,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
857B

MD5
04b994e38a35a308439e407e92aab96d

SHA1
22e7f60638b05f35e76060fe7e73a1d508b7f130

SHA256
f581dbd60c2b7e3e4196a26cd6d0fa8c4748d704aee9aec432410f54ee7860fa

SHA512
ccab642697cac5a9c464b30666b8ed0cd029abed8f6fbcfb221bfda1cc1b98ba0462491cfff54c4b44ee759db58fce09a9a042bc9dd351f1c7a8da12e9ea68d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d51cc5db89368b38a4727c50ba46122

SHA1
e91f956fb16c47dc614b4a65037ad90b42847578

SHA256
730d067c97528b8f54623ec96f3bdc69ac1b9ca68c531f89a987815fb5726f45

SHA512
a5b77c5cd4902145e4cef3cb083c09dbfd197ad0c0df6050fab924d9bd5297ad297d4a89e1ee22ba0ef91c95137b01324a92940a68ac8a867ea648d47be4c8a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a2a8cb28bb4ff24202b726bc74b97f4f

SHA1
d4cd1f3974427c5609c534477eecc2ba2f91b39f

SHA256
3b1fa2b0f39b3d7d1cc22297555fb7b8a6faf6b5b6ce08eb3f97286c1689b1cf

SHA512
26a95ec40b1bcf4fa3c2c262ef6aabe69362e2a13f9ff308cd5107364d8c7ee605d91c9abde5c1502efaa17003e3c0981c43ed9b97811d0cbf79987b07be862f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4a6621a8a6699c9af11f7ed717d94033

SHA1
a13d726af530a4fcb19060686c1ff214598f8bda

SHA256
79698e108e9752a4e98802de46aad9a35fcb1dd8c2c52d9fe17034425f0d0e1e

SHA512
d6c37da0dc0309b26697a7960dd2515ad56a3bc382ca6393035a4bd70653b233fe6bf40643e50715bd286c00ab0a39fd2a7c24b52ffc8b3a6cf6637c35605075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
734aaaf8ace3517b5394065ef1bf3e83

SHA1
12d00ff179885c2142bae0b600352d69e37d0fb7

SHA256
b3f155d924f0f4c7dc4e9cc5f6fc2695943a9f12ca625b173aea506928b215ce

SHA512
bdc01d9a9cef420d99cdfdba500ce7cbeccd64b0a13a9eaf62014665f7a637dbeb575896865b4be810d8c9167c4d470de217c9c923b313041dfaa2a75ce3c8df

Download Submit