867e9c4d4e6d42415ccd1376c0ddcd57b0c09ad96c5739f0a501cd4864117ff2

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2024 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1058c699980c826fd1673346be352f09_JaffaCakes118.html
Size

23KB
MD5

1058c699980c826fd1673346be352f09
SHA1

52511cccafb43609da10baf9ec8165dfc37584d6
SHA256

867e9c4d4e6d42415ccd1376c0ddcd57b0c09ad96c5739f0a501cd4864117ff2
SHA512

8cdb3fa1a8d28ebe41ef9a80b60b2f1115c6f49e224985c3d16106c734c2c3881889730f93376a9a1d238e3544f61013f435a31766014bcd6be463a12c4d6096
SSDEEP

192:uWHcb5nbDqnQjxn5Q/inQieJNnNnQOkEntWsnQTbnJnQZCnQtFwMBpqnYnQ7tn8i:8DQ/F7i

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1108	msedge.exe
1108	msedge.exe
4700	msedge.exe
4700	msedge.exe
4020	identity_helper.exe
4020	identity_helper.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 1584	4700	msedge.exe	82
PID 4700 wrote to memory of 1584	4700	msedge.exe	82
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 2228	4700	msedge.exe	84
PID 4700 wrote to memory of 1108	4700	msedge.exe	85
PID 4700 wrote to memory of 1108	4700	msedge.exe	85
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86
PID 4700 wrote to memory of 2824	4700	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1058c699980c826fd1673346be352f09_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa970046f8,0x7ffa97004708,0x7ffa97004718
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,6833305572492040759,2868541987813984346,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,6833305572492040759,2868541987813984346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,6833305572492040759,2868541987813984346,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6833305572492040759,2868541987813984346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6833305572492040759,2868541987813984346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,6833305572492040759,2868541987813984346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,6833305572492040759,2868541987813984346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6833305572492040759,2868541987813984346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6833305572492040759,2868541987813984346,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6833305572492040759,2868541987813984346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6833305572492040759,2868541987813984346,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,6833305572492040759,2868541987813984346,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f47f5b48fc6e4ea511e247ce5ac5315

SHA1
5fbcd1e87862b8660205f22ba642379db256db24

SHA256
297be5b37b05a86c956ef104314a895d8831036d7411f515dc24379b54a6f94b

SHA512
4d3915061ea38c222bf713059bbd9b6d01071a7738fa183898ef6ac32f4913107c31d47f48b481dcf815c30a3916c715411d1b9ad39241aae4d22d867effa1bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9ab5a0dbc44d154c45f1e26df4d49fb

SHA1
22ed31003bed95aaa2e37fae67b633b4b8b6b609

SHA256
13894f4f0f5d9f51f410f3be25c2314384175b6a886d64032a166e434deae8a4

SHA512
26fb381ff3984cb2aa5c3db9366642141430927d3e83be1d19cfe4dbe5a9e2cd089c256bc20dd8932d43f7b9b7b7ecaffdb2178a66c6655487b9c32469f3bc6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
87f60e89418253bf5c990a1c0d9d27c2

SHA1
d9defe5c261b5aa88808aca83c2206e67996415e

SHA256
f629c327d0fa188ec2c4e98991fcf44002dfdfdb445341ed46a8cc50cad2027b

SHA512
91f0aa23c14b1a18777e0802234ca08c149b8d3968f4b5808d10e02c536a0e910016a66cc3b6e4cabb1b11c283c8805bcc6b111a093cc96870c15371d09bba2c

Download Submit