b4b17f76b6b487653103d7c0ff1aeeccfe3fe0e1197be4a0f38df8f726538187

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c45780e1dfec9165fc5af4e78323cca_JaffaCakes118.html
Size

68KB
MD5

0c45780e1dfec9165fc5af4e78323cca
SHA1

17751ffedab9823859fa20532672d98d45cf0347
SHA256

b4b17f76b6b487653103d7c0ff1aeeccfe3fe0e1197be4a0f38df8f726538187
SHA512

d4359546ddadd7c7ecf17b953dc691d2f1c0ed8056c4cbe4cc29279e8c3aa1a025fb12cbce0dd0649e52a1ecd7df27006960a7e8cfa73c87fad7693822b75039
SSDEEP

1536:BB8lhKQDx1J9sk/x25AEHYNwtNNVY5icwAhE+MgUsdIqgiOln4XoUaOvX1IF1Pi+:Msox25mwY0cpVGqgiYOvX1IjPuOoJCrp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe
3156	msedge.exe
3156	msedge.exe
1644	identity_helper.exe
1644	identity_helper.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 1708	3156	msedge.exe	84
PID 3156 wrote to memory of 1708	3156	msedge.exe	84
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 468	3156	msedge.exe	85
PID 3156 wrote to memory of 3508	3156	msedge.exe	86
PID 3156 wrote to memory of 3508	3156	msedge.exe	86
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87
PID 3156 wrote to memory of 1944	3156	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0c45780e1dfec9165fc5af4e78323cca_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaab3746f8,0x7ffaab374708,0x7ffaab374718
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12156367831007834435,11123787362388882401,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12156367831007834435,11123787362388882401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12156367831007834435,11123787362388882401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12156367831007834435,11123787362388882401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12156367831007834435,11123787362388882401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12156367831007834435,11123787362388882401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12156367831007834435,11123787362388882401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12156367831007834435,11123787362388882401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12156367831007834435,11123787362388882401,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12156367831007834435,11123787362388882401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12156367831007834435,11123787362388882401,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12156367831007834435,11123787362388882401,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6120 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9dc60aef38e7832217e7fa02d6f0d9f6

SHA1
4f8539dc7d5739b36fe976a932338f459d066db6

SHA256
8a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32

SHA512
18371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7ac03b15b68af2d5cb5c8063057cc83e

SHA1
9b2d4db737f57322ff5c4bbddd765b3177f930ab

SHA256
b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700

SHA512
a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
73d06965744e8f67c826d985f0511e15

SHA1
2026ec194deb23843578fc4c0448d1cfa57e8bf5

SHA256
adf45846c4fb45fa8f9fe7d9c339301337c0e745900426029ec92145a7c4c3cb

SHA512
2aeae6dc507d9d3a02130a5c11e91ccad48402e5c9ba03c8310a39c9e10ee142ab24ec4013ef059c712ab30f8cfcb752e4f0019b5cb14cbdbdfb6af36942a2fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ed5d773b18e7c1d269819821f97b8e4

SHA1
d6fe7d5fcefe324a9462b655af2cd7f99619a0d3

SHA256
8d25ea865425bec9d0bc2fcc2867a5287093e7b859abb9c51cf54d5571a3798d

SHA512
a8ce2aaf5ad6e4db027cbc7f79f6bfeba6a0634173697279d5c058f2666634253215c467128e31f100a3d7803c84d099b075d61480be59302e058e758ea7af77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d2d28b2b7bc8ec74a8f8af298e04bdf

SHA1
bad1d620f4b39a021c260d9749f824cd234d0e88

SHA256
df1b35d0f8cd8947d8c14413c67e53316b6cc6b55b294ad09787ce06eb4d2be5

SHA512
63e98d9eff432d64cf535760df4db6cb659895f12c67978fade2cf85f74881e0d13f035148f029f90d4b80632b3d76c0c0ee32b8813acfffff7e040e117131aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6b5cd40d833310030d73482c6cd127d8

SHA1
90f834ade6d3b980b36af3601435ddd1cf6d4287

SHA256
cdd97edf8002a90a4d6d0ca61e02395280a9f59bace1b1b6feff00f3ab4be517

SHA512
3ba85027fe1c60412d16e0bb1647c1516a2f3e035ba59d3c552d254ac50408bd2c1ad71af160b9f180509a78e606437d41b11616b849cbb7bc1f9420ece317f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
7271c13cf5c4c5177408fb828ec24256

SHA1
5044c6f9d8790fe95c90876b9378d30358a7548d

SHA256
b6ca13d91b6084d568955a5466da8b3a408cfa73a587fa4da5751fbd1163663f

SHA512
f6bf2f9e264fda13184e6cdd73edd342623c73a4dd463b6608f59782ce968d447e2a8229438d9dd2742eb8f43662aa69c4fa375fb131d2043b47f0058032e508

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bb61.TMP

Filesize
202B

MD5
e6f423a0eb831f8c1d8f628f4ae2be41

SHA1
002595abe0eb3765f5bec022ceb16949260be06f

SHA256
59f4e91fb41659eb70b793f756cc7e642e730968d9d5f92ce323c410ddd101e8

SHA512
b72805d258c2811c76482c24d0b17329cc105aa5b093969632354bd3eb34b1f8794ecafefe0d828d852e8ed2f8292cd660cc985a5fa9c653e54bbbde992b4414

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cfafdcc0e54827f4202bb3f1ee83dd7d

SHA1
f97b5814ea682689e71d84c7aded5c0ffd45928e

SHA256
885a796a9dcc9c25d13286af897094c6aa5a894a0d5fe1d828a8c624aae740d4

SHA512
e0c3ad4ebc9bc3528917743ac54011a62da551efc37069caf12f885290ba23a8e2f75164d6fcbfe512ffbed23853a3443983a055bf6a6e72601f9d412d605845

Download Submit