b03c0ddb3a0dee4385aec381935adbae95edf14626cae237e9ef56a5f8246064

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c8bf95c07465bdd0b5a677382b661b9_JaffaCakes118.html
Size

36KB
MD5

0c8bf95c07465bdd0b5a677382b661b9
SHA1

c553f7088505d7d6a9bacc5df8cfd85fc38c4561
SHA256

b03c0ddb3a0dee4385aec381935adbae95edf14626cae237e9ef56a5f8246064
SHA512

f6952648c2c940d9ac75049682b0ac180051d1ce34ffe5cec13801fa3e2e5ebf0f11fb7d40bf1750aeba6e0d90648cecebe2dd4ef178afae64207fcb34b2f5b6
SSDEEP

768:j9FQW81D4RA+vEOjz6rdG2Gil54RZfPGnf3Gu34asi6781DdRA4vEOjq6h8aRlRP:5FQW81D4RA+vEOjz6raA7Ia7C81DdRAE

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
1056	msedge.exe
1056	msedge.exe
3640	identity_helper.exe
3640	identity_helper.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 3028	1056	msedge.exe	83
PID 1056 wrote to memory of 3028	1056	msedge.exe	83
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 4856	1056	msedge.exe	84
PID 1056 wrote to memory of 3404	1056	msedge.exe	85
PID 1056 wrote to memory of 3404	1056	msedge.exe	85
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86
PID 1056 wrote to memory of 3616	1056	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0c8bf95c07465bdd0b5a677382b661b9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffb47a046f8,0x7ffb47a04708,0x7ffb47a04718
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,10739928555555681812,10675900796226223975,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,10739928555555681812,10675900796226223975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,10739928555555681812,10675900796226223975,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10739928555555681812,10675900796226223975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10739928555555681812,10675900796226223975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,10739928555555681812,10675900796226223975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,10739928555555681812,10675900796226223975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10739928555555681812,10675900796226223975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10739928555555681812,10675900796226223975,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1956 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10739928555555681812,10675900796226223975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10739928555555681812,10675900796226223975,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,10739928555555681812,10675900796226223975,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
572B

MD5
d4fcd59d44abc7e065a51ed322a00eb6

SHA1
cabd92bddeeb1b1832b509e7bc8b86a81d63dcc5

SHA256
9e33afede8606dba12f8a26c9c19ed42db664b22408bb4388f6db40cecf4f6d5

SHA512
de21c7652c57f38fc96c9bc36c5e994be06cbab14b5e94bc1effcef55ff80bb5e497b47c2c15afe83c3f1a70f13705a7338b98cffda4fc402bf8c0721d116278

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f0d52677be9d9f91c9c35e9a567997ae

SHA1
ed54159e28a8932e531a432da4256651d9c908f4

SHA256
560206e133b3bcd1c6386ee46303bb86141110ea1780937a78127fbb32fbc89b

SHA512
74f35a6b74cc3438f59dec2f5a13a68cebdc04d70c0b0856e7f7e6750a33218fbce93c388e88fa146079898bb2d65cce3efdba4adcfaaa413e7b6f81e8d5ef7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d56b5f1bdb92862a9eb2ba8c7db2775b

SHA1
416230a6ced4892896b0bc66659b7af09f39b413

SHA256
815ae1d22504d39017a3c2b96e11584f673de1f61a1c09d8b0f18130d19aef62

SHA512
06c1b61fa598638508643bfbde9bf7b313cd82e02aaa7fc7e5c962867f80f471de9c42c5db24cec5c7f07ae36bdbb08a079497fe4970824f6108504b8da53962

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f6a0a63eda894e765f52ccf2668b6bb

SHA1
4ae664f3d29bdeb8859e978704ec0cc85acc4825

SHA256
ddf859e408e86220bf5d69a5ffb4bb830f36fca76be973e7d6353cf3c02f3c1c

SHA512
fd26bc613da75b0c8c4ab330706cfe9247b3543012a0f5607f6bfb8954749dd76d55c90166ab7634f383b2872f274564c3291aba8dad9ca370a2e9ea5e8e9559

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e848638fc2f929ed7a9c84b79d93a351

SHA1
aeec55be80bbc80880d93f537f649b66b298c02d

SHA256
61b86fe5b6dfda710316caa74fd5ec72304c3fdcd3cfd59d34911a752f884aab

SHA512
e497d7b13da45c593f0b69b068006aeab1de24a0b17124208e034552afce34e060285c5f4cbb2fcc757266b66bbbe1b23e5bde11ecf666e96201d78de12710e8

Download Submit