2e1f68422cfa1070bb777a493cc49423b37f0b1937bcc59e0b809836644f3285

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0bbe804b6a00ecfc433c8ac18651ef61_JaffaCakes118.html
Size

35KB
MD5

0bbe804b6a00ecfc433c8ac18651ef61
SHA1

2061876d773fc82419494e864e28c12d2f5bece4
SHA256

2e1f68422cfa1070bb777a493cc49423b37f0b1937bcc59e0b809836644f3285
SHA512

ed68296dde5b612f5241953e172bd425c371457943d8b59e65c9d18d2cd44bb037eefe0170ee218d452f5fbe266862301a8d0beb2e0bd8a3ba0b042e7be290ec
SSDEEP

768:zwx/MDTHyU88hARmZPXlE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6T4ZOp6DJtxo6lLo:Q/fbJxNV5u0Se/+89K

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
956	msedge.exe
956	msedge.exe
900	msedge.exe
900	msedge.exe
2676	identity_helper.exe
2676	identity_helper.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 4328	900	msedge.exe	86
PID 900 wrote to memory of 4328	900	msedge.exe	86
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 4528	900	msedge.exe	87
PID 900 wrote to memory of 956	900	msedge.exe	88
PID 900 wrote to memory of 956	900	msedge.exe	88
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89
PID 900 wrote to memory of 3584	900	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0bbe804b6a00ecfc433c8ac18651ef61_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe424c46f8,0x7ffe424c4708,0x7ffe424c4718
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,6187632409225194182,8021513153328315226,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,6187632409225194182,8021513153328315226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,6187632409225194182,8021513153328315226,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6187632409225194182,8021513153328315226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6187632409225194182,8021513153328315226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,6187632409225194182,8021513153328315226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,6187632409225194182,8021513153328315226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6187632409225194182,8021513153328315226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6187632409225194182,8021513153328315226,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6187632409225194182,8021513153328315226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6187632409225194182,8021513153328315226,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,6187632409225194182,8021513153328315226,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25ad83f9-d5a8-49cf-9e7a-a8fb43009bc7.tmp

Filesize
6KB

MD5
99508d630b3b0301d7692d85e0de707d

SHA1
706240b4e61867f074f469f5c455030995e33eee

SHA256
fde135872b353cc1b506520cffe95ec56d281aeea50f0c6cd2d978e598194a78

SHA512
cd13bb98ffae1703506b50ecebea03aa694af306d234be8b9dfe307c56a644cfcea21a0b52cdee5a2eac9cb9100b712f4000bb129ea1f481db7a0347cd717154

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57ab8a02b8fc8b2fcaf0efef36807ed0

SHA1
c38064fabcd94e15f7b72d2077993d99037bd601

SHA256
81ca4f29c9139ed2e9a4b0f8a16612ff0bae89f2815e164e3bc8e430ca81be70

SHA512
ecd6116ba7146ab3fb1fd6f82074d1bab2627707f291ebc73403f744ff9e7cd28713b1bcad9f7a128b732bb24c6791b1b9ec83353e804c446ae362b3410999bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
61dcbe8a1ce389df183d30cdacce49f6

SHA1
6219a623561bff3f3a17a700fb9d8e3e0fc7b7b2

SHA256
ef9f6fb966fb4071081d69e6409fc0291c80606cbf98eca0096b8026f3384ef9

SHA512
8a924634cf34d1e50e7072ba5f6369f6c9f10ac8c15cb3aa5534d8ba9aff619cd58b5a88a031ddde742f9fb6866ea670f50d8da80be0891dba833c9daf32f396

Download Submit