4a65b2b24f0eb9d82dd626bf5e3c79c4a95ce4fa459125771ec7f0ecf54d1057

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0bf77e5cae9691a7533060356a3e1815_JaffaCakes118.html
Size

39KB
MD5

0bf77e5cae9691a7533060356a3e1815
SHA1

70c09e268d2802d278a206148ae48e28077b0f42
SHA256

4a65b2b24f0eb9d82dd626bf5e3c79c4a95ce4fa459125771ec7f0ecf54d1057
SHA512

66c17c6397c1e6ebb5fb5cf6763d30c0c5c8e3cc07afcf2cc30d39869ee46e800bfc752b0e8d2d77f7be97f68ef06e7c1924d8cf0ad3acf1c59d0f58d722f445
SSDEEP

768:f+08W/ciJ26DiIOi1uYuocxvc3lpabdZCzfgGVwGb1KdCwMd88U3y297c:f+08W/HJ2XYRcxvcrabdYzf/sdZ3E

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
1800	msedge.exe
1800	msedge.exe
2388	identity_helper.exe
2388	identity_helper.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 4532	1800	msedge.exe	82
PID 1800 wrote to memory of 4532	1800	msedge.exe	82
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 3992	1800	msedge.exe	83
PID 1800 wrote to memory of 2944	1800	msedge.exe	84
PID 1800 wrote to memory of 2944	1800	msedge.exe	84
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85
PID 1800 wrote to memory of 3500	1800	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0bf77e5cae9691a7533060356a3e1815_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb633a46f8,0x7ffb633a4708,0x7ffb633a4718
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14115883720090239287,8788416018638434217,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,14115883720090239287,8788416018638434217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,14115883720090239287,8788416018638434217,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14115883720090239287,8788416018638434217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14115883720090239287,8788416018638434217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14115883720090239287,8788416018638434217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14115883720090239287,8788416018638434217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14115883720090239287,8788416018638434217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14115883720090239287,8788416018638434217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14115883720090239287,8788416018638434217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14115883720090239287,8788416018638434217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14115883720090239287,8788416018638434217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14115883720090239287,8788416018638434217,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
be52f4da7bb8c6cacd769d942616340d

SHA1
9481d6666d01872d4dd124cc9782ba438f7b06e8

SHA256
79adf8b5213dd163ac1b92e909e554cb607cbeaf30957e6eb0da7faae7ad0da3

SHA512
4cdff3c1be7a00998550c692dd51a9855b707e1b33f7de9a2b69d4ddc1d17e2bf0ce4dc3e2310635460381394eab20f4008849372fbbd0573397bc9e01b85d1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b0aa940e77e884fc0ae1004c3e2484eb

SHA1
c4ad2e5942152fa4ea4dd4d975df1550df7c05e5

SHA256
8be842f362287bd1149be9922f565dc71c88ad3f032186e5e46e2e52fb236630

SHA512
a2311f2f6081c42ddfa77b9a51338bcf4ffa9adba70be71db4916a013d0d8e0308c6d2897f41d96cc320ef88d910be060c6d220b61a70740094d2e0b370bface

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c03c466c15363509f45a816b9b106216

SHA1
a2ef1073b8a19672ee6d78f679b6f6e9faf82b48

SHA256
58103efd93fa153353444eb72df6d0b3126ddb849b9af519766f3367e52a2ea5

SHA512
f1a22ac9f304d8a1d1c1c6debc74285a9fe4fdb7bb2dfda93650a3bdcd1e7b2323be648f3a9f1961cc72471616f761d2d2f4c013a55378bd496686406d3818e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb9e32393a25f2284126d4005f76b4f0

SHA1
a9bf46ed8eeddce7a72a06c218707465cc58481e

SHA256
200625ab64e99463db6741b46eca704c13cdae54b3624180ee495816cf213d80

SHA512
2400bdc19c5ce9f56e87e0ddab8b27f6a9e897f92cdf97d1b3e2dd13669b9820c07caa617d989b7ab07097b7639ce3fa1bb1b2def77070f35bb15ba8f50f3942

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad61713a6f9ca69ec8b7aff727cac984

SHA1
afcec1815505e831e7aaae9d05babde6db0f57b3

SHA256
4afcf750a86a1b23445fef2206c2620784836929e6293a18c10b1e734a343a88

SHA512
fe05e0fd35d3de8cbf4a20d65e272d31871922fa92d5fd23ae707b1e0078c62275a9b4b8195ccb65d8d16288b860b821b53cbb7554e5b264fbf444c060aa2619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f48c73d889ec51659e9399031efccd98

SHA1
feb9f23260a863c2339a6bc0a4100a9813cff0b2

SHA256
f4945837b14e5550d653daa4ad4e99ed1e11bb42192180d915e72fe9dd5487bd

SHA512
6c45843328ad0e797f1ac45642ebc19caa6b159c582983f61fa42bc88f81fd1d4d02f8162204aaf069d530dd19023ec9ca0156a77925e4b012bf0abd26e1e686

Download Submit