52de87263566295b4530d39ca793df6301e9e0483009fd94c13549cd69cd4672

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0d122ed48bcbbc02fcde51a55e81942c_JaffaCakes118.html
Size

67KB
MD5

0d122ed48bcbbc02fcde51a55e81942c
SHA1

c572960512945d573a5674bf7591015aa78efca5
SHA256

52de87263566295b4530d39ca793df6301e9e0483009fd94c13549cd69cd4672
SHA512

792f7cdd782bdba3fe55ddcef785ca608a5b5731e3aa4ecec65f6fd369d13f59dafcaccf31cea1aff305df793b229fff65966423597a3e6f5d7d64c817ff4856
SSDEEP

768:JibOgcMsSZ8tN99OIsUvnowbwoTySqQCZkoTnMdtbBnfBgN8/oygcR/QFVG8c//L:JwRWhooNTYPec0tbrga6cuNnzIjv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
1324	msedge.exe
1324	msedge.exe
348	identity_helper.exe
348	identity_helper.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1668	1324	msedge.exe	83
PID 1324 wrote to memory of 1668	1324	msedge.exe	83
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 3508	1324	msedge.exe	84
PID 1324 wrote to memory of 404	1324	msedge.exe	85
PID 1324 wrote to memory of 404	1324	msedge.exe	85
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86
PID 1324 wrote to memory of 2220	1324	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0d122ed48bcbbc02fcde51a55e81942c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb83446f8,0x7ffeb8344708,0x7ffeb8344718
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,16718464794245680778,1044515503149305363,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,16718464794245680778,1044515503149305363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,16718464794245680778,1044515503149305363,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16718464794245680778,1044515503149305363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2848 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16718464794245680778,1044515503149305363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16718464794245680778,1044515503149305363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2440 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,16718464794245680778,1044515503149305363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,16718464794245680778,1044515503149305363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16718464794245680778,1044515503149305363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16718464794245680778,1044515503149305363,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16718464794245680778,1044515503149305363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16718464794245680778,1044515503149305363,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,16718464794245680778,1044515503149305363,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9dc60aef38e7832217e7fa02d6f0d9f6

SHA1
4f8539dc7d5739b36fe976a932338f459d066db6

SHA256
8a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32

SHA512
18371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7ac03b15b68af2d5cb5c8063057cc83e

SHA1
9b2d4db737f57322ff5c4bbddd765b3177f930ab

SHA256
b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700

SHA512
a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\515618d3-3313-4a18-8c7b-a6c82b836626.tmp

Filesize
5KB

MD5
8c4616d3c7dc67cd3f5603ab56c518ee

SHA1
5b905d16bd0e8f29404e0c1f5e2594762c20fc63

SHA256
943a910a958a262aef67ea3f957d4a19365549b64fe6c46b7a95d89a9ad5365a

SHA512
e083a8425595c26ff4b3a5cbc568b04c8cac650cfecbced89117a6aaac3ed8c745385807f36f46fff18091cc46e36be66f0dac50de7646707c92f56b756952c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
c1e2d4b2cc654fbb1ab81c8c90196558

SHA1
28fc00bba609211e16552c22cdc24d482a6dd6d7

SHA256
cd42fd867e4819c349b241534eb4d5e6811213258669e4272099fbd7a340a07b

SHA512
e72c0ad7b57af04f5211bc37ffee329fe777dfe7998449de174fc7e579af9f3eeec9923427e735f7eb9015696982c40b6863d1f5f635650efd91dc071963fbe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
410B

MD5
1033eeb4cf36632479172867beaeb6b5

SHA1
83846b798fccb278513f52b2cc82cd23539b1525

SHA256
bfd6b331425e080e4292a298b30bbd817b76a0a82f149d844151a8e0cf52df56

SHA512
1c74d17a537ad432092614d7f7f42b32f3c9d0aff39200786510a4414e38097dd53ceb000a0aee4a19e87968842f3c197f0c1b8bf7845ecdfd80eb2995370134

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5183541e05136bb88f15b1fd11c322f5

SHA1
18457d0d53645fa3a9bea43e63fb946eb51cc72d

SHA256
453bc63e1266576a862662d80c91501c420447014c56d0e8dd7f9fcae8811f36

SHA512
933b7e582e176806e442dcca02b3ce73fb41069ceb87a7fe29c674a15d11187e0207d7b871e131c4a1a4fd849f2aa0568dd3f947ed3a2379fe2bc8b2ba6d53b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fd2ba8c004b2140cbb006131446031e9

SHA1
37da50da6fd63a239160291c8181382bf62328f4

SHA256
d7abe2199c96eafc8c7c449d6cd69c8a73575997b02f17a432489a5480d3fc65

SHA512
d16d32f2945b2cc26d01b34fdceaeaa392365639396160c17c5bd6cbf34a75b05dfc6d484329db8f64e3e78e7e28883057d2c34ab259b89f8e97eb9f5c94830f

Download Submit