cd8c1fa3af1bd6874729b4f589ae3f1f8f39d9c003a275defa9c7f4914984458

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d97a5a00ce432ac9a8923d78faaf457_JaffaCakes118.html
Size

85KB
MD5

0d97a5a00ce432ac9a8923d78faaf457
SHA1

646840ea4c5dbea67831e0dfdd748e0bb708a6b8
SHA256

cd8c1fa3af1bd6874729b4f589ae3f1f8f39d9c003a275defa9c7f4914984458
SHA512

4121760246365e880a2d45128e6335ccb3a9d40f4f0ab9d6757f739715e3c17f006e3252470b97ce507ebe2782cfc168ca8f5c25ac895f56349d2437f07c0368
SSDEEP

1536:ayU8HOHq94Xz+B446uLa2MisWaIJd9t9c4pqVIRpKvdBkBzfmDYJrgl389:ayU8HOHq94Xz+B446uLa2MdWaIJsypK2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
944	msedge.exe
944	msedge.exe
4696	identity_helper.exe
4696	identity_helper.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 4648	944	msedge.exe	84
PID 944 wrote to memory of 4648	944	msedge.exe	84
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 5060	944	msedge.exe	85
PID 944 wrote to memory of 4544	944	msedge.exe	86
PID 944 wrote to memory of 4544	944	msedge.exe	86
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87
PID 944 wrote to memory of 3196	944	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0d97a5a00ce432ac9a8923d78faaf457_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xe4,0x108,0x7ffa184e46f8,0x7ffa184e4708,0x7ffa184e4718
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4288588861048135457,5654024823894930934,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,4288588861048135457,5654024823894930934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,4288588861048135457,5654024823894930934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4288588861048135457,5654024823894930934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4288588861048135457,5654024823894930934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4288588861048135457,5654024823894930934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2844 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,4288588861048135457,5654024823894930934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,4288588861048135457,5654024823894930934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4288588861048135457,5654024823894930934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4288588861048135457,5654024823894930934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4288588861048135457,5654024823894930934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4288588861048135457,5654024823894930934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4288588861048135457,5654024823894930934,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
efed0e04e990d3ef7ab8ec59d2f81e31

SHA1
f7ffb9f4b9517992bc55b0fc035a800df9ff1b11

SHA256
037f0717c307519cd2bd9442fe4e81facaba4773571a325fd87ceebe6a14bba3

SHA512
5353cb3fc480c205340cd047926eda76d7ba61f762a4866b474589afc7eadccd70e69f300cf4201a67dd85f82f94d8967c2bca87ce668a7bde831d31194f9d42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f250a7cc0dbb0440440dec1584c5d11e

SHA1
1e2c767c48457deb212ed937f82c29550e673606

SHA256
fd41a98879224cbbe6d22712c0a93a63c4a6cfa54c9f83650f8e6fc94d282bff

SHA512
3da2f3e1b09ef68ea1b850a605ec262a0a665c4bb717912264c0fc154c718c9a3be56088c5bf9bf86b242d007135517a877ada7726de320c657dd26e5ff07676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fdb3d443dcc96d1537c32f98b4fe96e3

SHA1
980346c29937faa2ee97814faeae64b2c3920cc5

SHA256
5b598d5a5a7eda94e2303ec35b8d6f3504fb8eac65dee941445085bb2277c4df

SHA512
df575e44937d219fa1d58c70c9d165cbe88f95ffd6102f421509630289a7e307bbecea287c63ffac4d454cea4172359533b31427b52707a0c6445ba6655ba6c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e6b9568711d194f9c5a8325647433ca2

SHA1
ca2a20e1b7f82bb426898ac22d8dbabf20a98285

SHA256
2a76414087adad93b18329705b73b75be18bbb60434c8abdf4edb23be8023c1a

SHA512
fa1cdfffd885dd2c5e2d7892dd8c6597338a6226bf5b5f135ac29ef32653512d242c825d1a8d165de4a7e5be94fbd2903840d904a4cd5c23af78e8922e55bd5c

Download Submit