78df8b6a6d628032798bcbca71e6e9d92e31d8cb0a1758dd8836d8a28ddaf432

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0bc2c851313a96cfb59879749edfff2c_JaffaCakes118.html
Size

345KB
MD5

0bc2c851313a96cfb59879749edfff2c
SHA1

d3fdd3730074a6828e943b35c2020ab8e0072819
SHA256

78df8b6a6d628032798bcbca71e6e9d92e31d8cb0a1758dd8836d8a28ddaf432
SHA512

1cd58a2dcc4ea1e7db0b6d99d9eb19faad9e9d0754522013dfe4c726ea016055b048529dab7d8eb82b906f7b1e71723d169df44cb7a046ce6a7e0de970dd2c05
SSDEEP

6144:SIsMYod+X3oI+YBSBsMYod+X3oI+Y3sMYod+X3oI+YQ:55d+X3GN5d+X3Z5d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
516	msedge.exe
516	msedge.exe
4416	msedge.exe
4416	msedge.exe
228	identity_helper.exe
228	identity_helper.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 2972	4416	msedge.exe	83
PID 4416 wrote to memory of 2972	4416	msedge.exe	83
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 2280	4416	msedge.exe	84
PID 4416 wrote to memory of 516	4416	msedge.exe	85
PID 4416 wrote to memory of 516	4416	msedge.exe	85
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86
PID 4416 wrote to memory of 2256	4416	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0bc2c851313a96cfb59879749edfff2c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c02546f8,0x7ff9c0254708,0x7ff9c0254718
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4031225505266330477,16528792222846107416,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4031225505266330477,16528792222846107416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4031225505266330477,16528792222846107416,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4031225505266330477,16528792222846107416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4031225505266330477,16528792222846107416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4031225505266330477,16528792222846107416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4031225505266330477,16528792222846107416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4031225505266330477,16528792222846107416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4031225505266330477,16528792222846107416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4031225505266330477,16528792222846107416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4031225505266330477,16528792222846107416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4031225505266330477,16528792222846107416,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ff88bbdc809c05354fc62267aebd19e5

SHA1
d8b9f1c44453a4c33330fca5f2a70f2616d327dd

SHA256
f391a424b5b58ac1df00573a0d7f4a98a3e58caee19c20638a3600a5399d51e5

SHA512
a32c4cd6d30538ba59de10fab68144d5ade5fe6b33c52ed92f625f05e3b3d3192c727d84872b144910e138f9058b4f71a3e255dbb586d95d0fe2065924d3a5d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f34821b34a6cee90970261b7e1d6ec83

SHA1
cec61b169f820a2ef1725099a9ebbbf30f855ade

SHA256
557628aec04f96b8478c902334697fa754678850b7d9c56c8a99f3e738230b94

SHA512
0047af5d05b9f6eab2edf4eddcfa919788d60b5daad56065a10f7e95b6482533cd5907ad06930bb6789e2095004aa5b35b7887534581302b48487a445c4392d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
44da59aad4a0285aecfcdda8bdb38478

SHA1
7f14986e894b0ec3591ff7b3fa3e7ea7c0b5fe56

SHA256
fe0b81c0ffe16b9f8846573a9b2361483d01d55464d5f9b3080b19fa0a41c709

SHA512
2e96fb36139b9e78752bc50c9d823b66f908198d921d5330a28dcd2538bfc0ba421eff9bf88b1ce7a9ea72970734e89f57a38160f742e4f788802b639265bf18

Download Submit