f9ad4d5338ca96c9dfee6b9892f518a03591c96a7250b346b9cdf5486afc6320

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2024 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f9ccab95049a200684c030da0652cc9_JaffaCakes118.html
Size

192KB
MD5

0f9ccab95049a200684c030da0652cc9
SHA1

346e887f3e5ba012e2ac5fa4c9b3b4e8302a5783
SHA256

f9ad4d5338ca96c9dfee6b9892f518a03591c96a7250b346b9cdf5486afc6320
SHA512

6b9c18dd756ba920c49288000d50c624450b00fc8d3f629775a577649ef863ded101e6abde565e58050688d1ea2d9335293eaca03cbf4e7a474cf94a415d32df
SSDEEP

3072:SMqfLKzKy3yfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:SWOyCsMYod+X3oI+Yn86/U9jFiM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe
744	msedge.exe
744	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
744	msedge.exe
744	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 208	744	msedge.exe	86
PID 744 wrote to memory of 208	744	msedge.exe	86
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 4488	744	msedge.exe	87
PID 744 wrote to memory of 1092	744	msedge.exe	88
PID 744 wrote to memory of 1092	744	msedge.exe	88
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89
PID 744 wrote to memory of 956	744	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0f9ccab95049a200684c030da0652cc9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe424c46f8,0x7ffe424c4708,0x7ffe424c4718
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,9325268685143028347,14705192430801438990,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,9325268685143028347,14705192430801438990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,9325268685143028347,14705192430801438990,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9325268685143028347,14705192430801438990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9325268685143028347,14705192430801438990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,9325268685143028347,14705192430801438990,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0c874c38ca33d7fb640d43d19d582193

SHA1
3e2168e118f2eea6129cb991a67119ff8810972d

SHA256
869e5e45d07c0b649407c5761f14a4462512650e391dce469e5868259601ff76

SHA512
a77af8d9bf477fb63a18729fbc354ff0fc2e2f59264ee4dc2fb334421f6f6ca5bb2cd697f50dc3972c55417ce3a750e5847897d6795161281693164b4545dc11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b9e7643c3f453f21da521e28b53df9c

SHA1
97018987e18278a33cfc2afa6f97234f767cfde2

SHA256
0a43f80a024acecd4e23da4107d3df524493f2158c3e4c91109730779fd698f8

SHA512
18bb40a772671009624d3c8d4398c0ff6e22aee1ee2c4b8007ea6241e98b41ae7d008ea95a048a1938c5aca825a0c7daf27920b965ebfa364b1159806e744e4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
94025c582a90d0deae8ce15e0066730c

SHA1
2d645f95af44b36a49518751327bc384b47eab1f

SHA256
bcebb3cac96e0eb508593b891f5271780c3d6741e5d0fabb4c0b22b264c030c2

SHA512
78ff17dbefd547e21a446c8f9f090062d6e297d17daaf91f4b72f5a61b8d47651404cb2e5ac2354c4d22b70b0adf889fb7cbf96137c02e30e559229d934735ed

Download Submit