c5b799a2459c01f9fc5dee800adad253e4ea5e26a5d9e6d84c0b07f9b01dbe31

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

106da421d7d9bcb45edce6013fd48ff6_JaffaCakes118.html
Size

4KB
MD5

106da421d7d9bcb45edce6013fd48ff6
SHA1

6526f466d5af21ddabbfa6d25215b502ce423c1d
SHA256

c5b799a2459c01f9fc5dee800adad253e4ea5e26a5d9e6d84c0b07f9b01dbe31
SHA512

ba6795e91332c4e73c2b5910222cad77cebb04b1ab0251241be797066e3d5dcc7299cb31574070bab58460bebb31a710e287d489e647bd0c4b341489a37be5fa
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oBned:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
4344	msedge.exe
4344	msedge.exe
4292	identity_helper.exe
4292	identity_helper.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 216	4344	msedge.exe	84
PID 4344 wrote to memory of 216	4344	msedge.exe	84
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 2064	4344	msedge.exe	85
PID 4344 wrote to memory of 3752	4344	msedge.exe	86
PID 4344 wrote to memory of 3752	4344	msedge.exe	86
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87
PID 4344 wrote to memory of 3968	4344	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\106da421d7d9bcb45edce6013fd48ff6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd145446f8,0x7ffd14544708,0x7ffd14544718
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,13884244598032310319,10065326431297479017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,13884244598032310319,10065326431297479017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,13884244598032310319,10065326431297479017,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13884244598032310319,10065326431297479017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13884244598032310319,10065326431297479017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,13884244598032310319,10065326431297479017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,13884244598032310319,10065326431297479017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13884244598032310319,10065326431297479017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13884244598032310319,10065326431297479017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13884244598032310319,10065326431297479017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13884244598032310319,10065326431297479017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,13884244598032310319,10065326431297479017,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
46206e241541a6efef0440fd892347b3

SHA1
419646fcbeb5056f3182dcffe8169e4c918f7318

SHA256
b13afae4c9358e597e145935cda3ba7f306b006871ab8c2c0f6cf052cf7a04bf

SHA512
c607781a342af921a615f16a53e696e5affa403df69a0b785ff7f77e5d8d8251aab94503c7306435c80bd7b1acbaf6bb3bb3ff3a29da4df0daba0b026e4c0a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5ea3ebac74d5a4d8b3db8ba78c0a1808

SHA1
3319527ad40674a2947ec9af37040fef3415c210

SHA256
f20cccfc2307a9dc5ddc915b420535b17f229ba793c473e24847250f8206acba

SHA512
34fd5e00d742529191d7023684c126e344fc23c3f7b36e666f39eff9803d4938af50f4d0d127b7f6089ff914084c1cbbaf40771387ec80a0fb9518abdce1bfd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc1404275d2b850f3a2682eaec331623

SHA1
bea18bd29a57094af9f6d9e8ee4a0361d5ce039e

SHA256
bb6cb3e71da4df0d1318596cc2d481151dad10942982b62c6ec428a4d12fab47

SHA512
7d612ef777ba2a5d17fd6419be37882ac0af56c95a7ee6b1f11c3c2d25384f9c5d2d5c7f7cce137b28fba69951cee68609f89506a42f2489dd136e6b9e75ebee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
46408757e7962ec2659b41125dde6ce6

SHA1
367ebfb13bb87158dbcfa43d1fd16424cf8f23a2

SHA256
568b45c4e99314976d053f1bf7602fe592aac2c134b4201e7a361196baad9e7a

SHA512
7c5658a5136425b37b071e65fdb5b02a031f0704ce92d7acb2290292f9fb13b88be955c01e2bb8fd9a51a612b579e324e52f35a03fc78afcbfe45a37a10b5903

Download Submit