d02d6dbfba2d41632cd7264dcf1ab429f90b77870565187aded6709ef99b6641

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e5fa1345a3114e42661695620758299_JaffaCakes118.html
Size

40KB
MD5

0e5fa1345a3114e42661695620758299
SHA1

a634b0e647c52bbbaf681d21fd3b2151cc963309
SHA256

d02d6dbfba2d41632cd7264dcf1ab429f90b77870565187aded6709ef99b6641
SHA512

07b07569adf826b3f441497e098a0021dfda73c707d7b09fd768f109f6eb6b5461d4e34b45d63819897d1c3adf4e92d2056d6fd19d03afc065d201a8b01b4486
SSDEEP

384:JmIoSfoqoA3ldig6XVuOUHw+d3A/iOGgt9Ie+UR6RTgZpM4LezrP+6I3pT7KNUjt:tf5JTQK2CSMD3YkN0kWbsJE9ar9SBp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
1816	msedge.exe
1816	msedge.exe
644	identity_helper.exe
644	identity_helper.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 4248	1816	msedge.exe	83
PID 1816 wrote to memory of 4248	1816	msedge.exe	83
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 2312	1816	msedge.exe	84
PID 1816 wrote to memory of 3680	1816	msedge.exe	85
PID 1816 wrote to memory of 3680	1816	msedge.exe	85
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86
PID 1816 wrote to memory of 1972	1816	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0e5fa1345a3114e42661695620758299_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff901ee46f8,0x7ff901ee4708,0x7ff901ee4718
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12442853857784178410,7759614379763369618,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,12442853857784178410,7759614379763369618,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,12442853857784178410,7759614379763369618,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12442853857784178410,7759614379763369618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12442853857784178410,7759614379763369618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,12442853857784178410,7759614379763369618,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,12442853857784178410,7759614379763369618,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12442853857784178410,7759614379763369618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12442853857784178410,7759614379763369618,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12442853857784178410,7759614379763369618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12442853857784178410,7759614379763369618,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12442853857784178410,7759614379763369618,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9dc60aef38e7832217e7fa02d6f0d9f6

SHA1
4f8539dc7d5739b36fe976a932338f459d066db6

SHA256
8a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32

SHA512
18371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7ac03b15b68af2d5cb5c8063057cc83e

SHA1
9b2d4db737f57322ff5c4bbddd765b3177f930ab

SHA256
b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700

SHA512
a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\77efd10b-b3d9-435a-ae9a-558a8773a5de.tmp

Filesize
257B

MD5
c875b6b6c62ba0addf5122a32b5cd712

SHA1
a02dbbd3742cadf4273f7d79bf7dec98b1f7d82d

SHA256
6012c615be67a494233f2f72c6f102efc044adf388e466623baa59d9fa93fb10

SHA512
699b9e1fdb9b7e572e972b14b9188c042899e1839e72df6980971bc9ffd7ce8d6cb68a805bc6b12d778b2a048fd7c3dd7282de0a50d482c47729ae925f0a8ba1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5e0ef208f9099129857fa2ee79934f7e

SHA1
9391190a6cf07aeb42960e0c640b19feaae0d75d

SHA256
b5fe81521b6c3783a167e968f3a2cf67d0df492d62461d21e92c4b107d8501dd

SHA512
c9f89ab903d047ecf70027ee35d85fb3f433ac93684e53208e4f8c66a424bc08a2e340613e4199537adaa0ea46ad4d542753700bc6e0ae89fcef9b69400f0f58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d48f4e484a38a8083abf143dc929f613

SHA1
1e495cf9850f6f8dc76eb8cf62cf84b48741caea

SHA256
ad11ee19ef23d3a5c433e8ad0f836945d13d7e0a920d218e223fa2b3aa8f8520

SHA512
840b727f768db2775a7e26764bd2e5d6429f09e849799fd69cd60f644d9b698c2653d420d593f77aaf21eb33837f2de006ab26e403b6af99c87e60cf4a65e99b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7b478d4b7111acc82de9bdd36b19fa90

SHA1
5cb754046d9f8d458df28642c0a5bbb120f70fe3

SHA256
50f2fd5b795124b430b45e21162493d26b9e25607dc7775a1421ed0eb5c8e582

SHA512
0a1075933abb1ee09fa8ab9aa16e79905e3ba3aeb6daaf81f6e3ad3bd8fc77e4b488b3933c74d25ba05b3c68314ca9810a049779ca9381649c7b126a42763ec4

Download Submit