57a51d4b794f63094e02d05ff531b09ef82ec8d10cd526da040b534b7ecdb952

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e6389947a91d8af11a46d17ae00ec84_JaffaCakes118.html
Size

299B
MD5

0e6389947a91d8af11a46d17ae00ec84
SHA1

fdeef42eaeb1a8440fd704403c3928fc7dca3d0e
SHA256

57a51d4b794f63094e02d05ff531b09ef82ec8d10cd526da040b534b7ecdb952
SHA512

c030bf6713210283771d8995825c5fefca0f299ec4e5923f347a10b8c61a09933944e9583e844c814bd84676987886b08d21e25579e64b76d6c94fbea7e3c3d5

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
5288	msedge.exe
5288	msedge.exe
5160	identity_helper.exe
5160	identity_helper.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5288 wrote to memory of 1068	5288	msedge.exe	81
PID 5288 wrote to memory of 1068	5288	msedge.exe	81
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 1820	5288	msedge.exe	82
PID 5288 wrote to memory of 2240	5288	msedge.exe	83
PID 5288 wrote to memory of 2240	5288	msedge.exe	83
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84
PID 5288 wrote to memory of 3560	5288	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0e6389947a91d8af11a46d17ae00ec84_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a06c46f8,0x7ff9a06c4708,0x7ff9a06c4718
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,9069408048383026277,57400904751497375,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,9069408048383026277,57400904751497375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,9069408048383026277,57400904751497375,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9069408048383026277,57400904751497375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9069408048383026277,57400904751497375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9069408048383026277,57400904751497375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9069408048383026277,57400904751497375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,9069408048383026277,57400904751497375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,9069408048383026277,57400904751497375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9069408048383026277,57400904751497375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9069408048383026277,57400904751497375,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9069408048383026277,57400904751497375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9069408048383026277,57400904751497375,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,9069408048383026277,57400904751497375,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
384B

MD5
4da4f5eb4d1c4340e36540531d26ae4b

SHA1
20f04751d09d614e077cab833af57a2762d62c7e

SHA256
0ba36b78a7c8c30ecb3c9e19d630a936f5b0e4c775bea6442f03f458932caab9

SHA512
cc807cc5b33f6733496d6968802cd99ba00118285cbb047db8854a2e6e960258fd55b4ee80dbef6666b3a2a8d74114655bf73e64436ce2d6da108fdf82bb2854

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ab042b2b53989a387081ac52f27093f1

SHA1
36caa1f19f0b8f5b5eb29caf48926e189a0b161c

SHA256
9a5329e752b3b8f2076d38410d12dbcf8b2e6893544a78cfc1a7f45bbe0558de

SHA512
8bce91819cf0773727a5f2ee31a1a39380a40785a094f147954c62c7511eeb69f6e3e85a57b6cecd305260c35d6116f56f0d1d9ed487887d077d1156d9db06d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e7d6d5393344bc6e9dad639d73b6733e

SHA1
65ab84bbf751559c03b81a20570a0273d3715a15

SHA256
1f7a72188bc18bec4281d186657471ae152ae291aa38f5dc18b85747c937496f

SHA512
006cf6405038dd96f122a935a3d99d03ca564d8e9793fc3d8226455a66c518b8f22f74c2039ebc710ccfe1f52308317e7cfd76afc684297c9b5f014a5ac14c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9f43b6dc92d8fa29de44cd7b2310bcb

SHA1
e4805b11bf671058a130ee353194bda1568ba992

SHA256
f1f3b72f9fd39413e275ab82446d19136324b96594df3d490be0e0728d6e4789

SHA512
441a2a3e980e900c67683740e441ab27995c58a697a99cfae7c534dc9ec002a98e50fea8295411c3ee8eb7534809f5d01a3758b406d286a6482bf7119a7ddf0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5f9961ddb7cc8bc05810ea5b445cf9f4

SHA1
a399f87f289ac6165ea8bfcc235dc4647265cc29

SHA256
14824761d4ef236149a62248aa76c142dd5539de910f1a0d675df2f9350da9ce

SHA512
3551ac0899ca8b7308f53d6eb99258ec5846a7f666c1c0fea7e4ce186f81999db190cbece0205e65357f18b46bfa515fbad91e5f14d2044169276b850ed7bb46

Download Submit