5f8e44e2bd23a15820507197681aff7d0b4f23a04c73b28b90910fd43d97b72b

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e31b519ca33ce31f9b4d49418f0a232_JaffaCakes118.html
Size

35KB
MD5

0e31b519ca33ce31f9b4d49418f0a232
SHA1

df710780c030737e6eb0f2e2e55a189d2baf11ad
SHA256

5f8e44e2bd23a15820507197681aff7d0b4f23a04c73b28b90910fd43d97b72b
SHA512

931fe12f72e5ebe0431f9dab52fc34e6c5dd5db298e2c5e668bed6e2def3caeca7c6db9a46116cebcd9f4238b8f59923a244fa0bb6a13bcff16c38e6f3deb538
SSDEEP

768:zwx/MDTH8G88hARgZPXXE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TsZe6zB+6OxYy6B:Q/rbJxNVwu6Si/k8VK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
1868	msedge.exe
1868	msedge.exe
948	identity_helper.exe
948	identity_helper.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2764	1868	msedge.exe	85
PID 1868 wrote to memory of 2764	1868	msedge.exe	85
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 3980	1868	msedge.exe	86
PID 1868 wrote to memory of 4796	1868	msedge.exe	87
PID 1868 wrote to memory of 4796	1868	msedge.exe	87
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88
PID 1868 wrote to memory of 4484	1868	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0e31b519ca33ce31f9b4d49418f0a232_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fde846f8,0x7ff9fde84708,0x7ff9fde84718
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13257753524984688128,17880453743363851801,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13257753524984688128,17880453743363851801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,13257753524984688128,17880453743363851801,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13257753524984688128,17880453743363851801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13257753524984688128,17880453743363851801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13257753524984688128,17880453743363851801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13257753524984688128,17880453743363851801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13257753524984688128,17880453743363851801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13257753524984688128,17880453743363851801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13257753524984688128,17880453743363851801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13257753524984688128,17880453743363851801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13257753524984688128,17880453743363851801,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
613B

MD5
f61b8a7ba38f62d2971880abd5cda3db

SHA1
c3058499a28e4bfb2062a35d862a0c5355dbd29b

SHA256
1b334351d006a165786f8fd7c9c147f0f16c1e69967ca07bc93b9b5910ac1053

SHA512
70894fec276ef2f73219e06550d9e7df8e1bfba0fb232c7f24be7421cdc943f04e8e18687924650992fff119d0f4793be5899dddaff8191a4b14f09317ca9aae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
69ae00c665c4335477172ce9a245eb44

SHA1
133cd14390b07e3c432928228628612088751755

SHA256
c7c3d4368349db4954e34d972dff32b489e134114e3c46297bbbe652e205d939

SHA512
15626fb505325b2d5511b7c51a4b5d7a37cfe59e0aace194e8c2600ac806f76a23617938f88edf0be879340d00ca08674734696e432bb762350d8eb1e5e056c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5cdb6d9f6ce140d6bad10019f4da5ab4

SHA1
03bf55ef23b65c84d01ad53ed519ed45bd0ebb41

SHA256
eba53d3ab8008075d30e547b2cba3dddcfe46c92b3cbea3691367b343934aeca

SHA512
91ad11b9bf1888990061068dfd55a110cc4d1816bd227eba0671a91f6eb05971bd879ee92f4e187976cc69749688ff771378108560f7218efa769f0e164eb89b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
73978bdef36ba572b4990a94be02f2d9

SHA1
c327445086dcba32ed374caeb0f1faa34ca5e494

SHA256
7a010470ec1156d0cf0615f74f21b6be41351ab0f24060d2f9b421bd172800ae

SHA512
49df4f37de3823b78556908f874a7260185214a856b21c3d6ce273f26b94182e82e345616664c27980e57aa6976c123e8b78e6760a5a9900b465e03bc3b1e46f

Download Submit