2ebed3440fb71c64ac9eb8e36666ddd87dbacfa18ae44469bad89da7d79754af

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0e16418458a65b0c166dbf59e31c1509_JaffaCakes118.html
Size

4KB
MD5

0e16418458a65b0c166dbf59e31c1509
SHA1

fad90756034be508a443bc5cefba027fc1d16000
SHA256

2ebed3440fb71c64ac9eb8e36666ddd87dbacfa18ae44469bad89da7d79754af
SHA512

5f017819712c7f7d6c4d4e8024cfdeebbff80e59929fc463eeb16433a451ff45cf6fec21c789f0e091b20bc7de1bdfe2c0676e4b14d7f635fd906a702cea3ff0
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oCNwd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
3864	msedge.exe
3864	msedge.exe
4292	identity_helper.exe
4292	identity_helper.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 1836	3864	msedge.exe	87
PID 3864 wrote to memory of 1836	3864	msedge.exe	87
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4632	3864	msedge.exe	88
PID 3864 wrote to memory of 4456	3864	msedge.exe	89
PID 3864 wrote to memory of 4456	3864	msedge.exe	89
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90
PID 3864 wrote to memory of 4896	3864	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0e16418458a65b0c166dbf59e31c1509_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaeef746f8,0x7ffaeef74708,0x7ffaeef74718
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,15932246408801842085,16938568382223601183,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,15932246408801842085,16938568382223601183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,15932246408801842085,16938568382223601183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15932246408801842085,16938568382223601183,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15932246408801842085,16938568382223601183,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,15932246408801842085,16938568382223601183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,15932246408801842085,16938568382223601183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15932246408801842085,16938568382223601183,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15932246408801842085,16938568382223601183,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15932246408801842085,16938568382223601183,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15932246408801842085,16938568382223601183,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,15932246408801842085,16938568382223601183,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
d270c20a22f9d622a4ea965c9e44964a

SHA1
0c1e4523998a829a9144bacabfe96474cb8622e5

SHA256
c30623ba1d616137ddeb3c9add8515bfe73a533f544c52382d1c41907e7cc4a1

SHA512
3cc42108326aaf44e085cca969cdbf684fd1db8f6159dff15cf795704ba013fcc7b675c74754b1201f53ba4732c8ff7f2356df149f99760a4c6458cdaa3b0ba1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ae70423678a1fb4c5c11532fc707034e

SHA1
51db6204309dc59d485370b5e8c9b1720402653e

SHA256
305e2362116042e29e8a09fb9084254bab506d0fdc757b398b68812eab171816

SHA512
4ebb66294a38a518240467c78b9565abf4f1da5a83800ecc52ac1f4c6e1079d3825563ab7b8cfd68a6b703ce42ec7b1ef924123c7cb4a6fe01f2971bd2112042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4afbb2e5ff6659dd9255412bf6f54223

SHA1
5082498f610b7de91126637a2807b6b11de9fb58

SHA256
7da0d498ea5b3fd0d2da51cf0d540877c7b561ee9386b4ae4d34ebf13cde9a5a

SHA512
b05979bf2f9d8fd14f8c2156d81dfed8f519df1f0bfcaa27a2631152bb49e0e402102300211a2b46dd0053833d7c47c95b8e5a43fed09943f2036f01e0fb5fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4f69c9dffbd07d2a5366a40fb6e92d4f

SHA1
8db9aad464b282311087225daa670db194ad5dbe

SHA256
e623fd0968b08ec129eef0fc34d0b0038044d79b3d2d4c80d099f4294e1e5124

SHA512
54e008650f1dd743a3c1f70f58fad14fa32134066bfb03d033e8ce550781f379bc9db67bbc0fb46d0856d6261ac1f53f968b714d1ec1f02c6312a8ce4fab2a89

Download Submit