ea75594bb60becfc79bb167b4425803aa84fef872871ebf788bbb4405b3960b6

Analysis

max time kernel
145s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

104ccee075bf6af4844524ddbcf56f56_JaffaCakes118.html
Size

231B
MD5

104ccee075bf6af4844524ddbcf56f56
SHA1

b742792403cb0a3d5044e2800cb901eef6a3e665
SHA256

ea75594bb60becfc79bb167b4425803aa84fef872871ebf788bbb4405b3960b6
SHA512

4789b64bc1e5bb0000c3811a5eaef95ebe321d2586de59b7acb3c9480d48460dc248c8d556e80a456a642b8ac9dc7213e13a94d5fc9230bf35a827550f671350

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
4028	msedge.exe
4028	msedge.exe
4940	identity_helper.exe
4940	identity_helper.exe
5196	msedge.exe
5196	msedge.exe
5196	msedge.exe
5196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 1056	4028	msedge.exe	83
PID 4028 wrote to memory of 1056	4028	msedge.exe	83
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 1920	4028	msedge.exe	84
PID 4028 wrote to memory of 3636	4028	msedge.exe	85
PID 4028 wrote to memory of 3636	4028	msedge.exe	85
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86
PID 4028 wrote to memory of 1332	4028	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\104ccee075bf6af4844524ddbcf56f56_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc2a746f8,0x7ffbc2a74708,0x7ffbc2a74718
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,485461851595565729,10447852474282051414,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,485461851595565729,10447852474282051414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,485461851595565729,10447852474282051414,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,485461851595565729,10447852474282051414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,485461851595565729,10447852474282051414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,485461851595565729,10447852474282051414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,485461851595565729,10447852474282051414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,485461851595565729,10447852474282051414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,485461851595565729,10447852474282051414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,485461851595565729,10447852474282051414,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,485461851595565729,10447852474282051414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,485461851595565729,10447852474282051414,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,485461851595565729,10447852474282051414,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d323d5c2e500234e85819a7577319744

SHA1
69b1de2fee5beb2b48ce1007a1a8a3566519842d

SHA256
c0afd248ad21d34557a052f009cae2f5915f31fe6dc188d291153c28004f0efe

SHA512
91c975ba3a207dbf051b486b88f8b70dd7e442299d097d8a7e46425135df2d92e6d1a600a5ea60def49880d40cf269a4dc6467c572f9d4ada74426883983e8d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
401d01f3024a84ab08e9637d2abd6264

SHA1
7edb789b0ff02ac657604499584bd54698eb9f4e

SHA256
92ab72be72ba757604cbfba35aac49d738b140a65f5f9d298307fcbbbb4db07d

SHA512
a47f7ae5c478ec90b5e6b7e77941376d8064a74687b7aa1bd75a665271e2dbdcf362d72bd12767becc71754c1052a168c09237f990064c9eeed33c3b7fdc36b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
31447056f262e04c811eeeaf244850ee

SHA1
9275d2b3b39ce0b3438dde61ba9ba4203bd4735f

SHA256
51020e2de6c3dac3774c9c202f4300f92671a168345fcc2f2c8d4a98dec1aa72

SHA512
769ca322da2b50623a017d4d913ea4c993b9e35afd70f8deac2f55d50b828738530cc2cd88093900894a4fe8895c931b76af5471a2624064889d2e435f6431c8

Download Submit