9013ed5cd3fa58670c50e30cbb093ccd8605f80845f01dc2e8c19ff8f3f6bdd4

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10924a7bd7efc02236806ee4e4c70bc4_JaffaCakes118.html
Size

17KB
MD5

10924a7bd7efc02236806ee4e4c70bc4
SHA1

41bf07158d3b71bc0fd72e68344772dbb4f20eaf
SHA256

9013ed5cd3fa58670c50e30cbb093ccd8605f80845f01dc2e8c19ff8f3f6bdd4
SHA512

020f3febf9a1e39a2494c1a66b17d6a9629eefdbf75cac7cd7b47fa3c157b818f0971572d07193dfbfb9e786c189babfdf6116cf34dae1e87ab4a800cea05054
SSDEEP

384:SwdKUy2ZfzG6MnaeyjyWXh4+rb+lO+rU+JG+iU74EJ:Siy2hOaeyGWXSp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
3080	msedge.exe
3080	msedge.exe
3480	identity_helper.exe
3480	identity_helper.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 1188	3080	msedge.exe	83
PID 3080 wrote to memory of 1188	3080	msedge.exe	83
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 4636	3080	msedge.exe	85
PID 3080 wrote to memory of 2636	3080	msedge.exe	86
PID 3080 wrote to memory of 2636	3080	msedge.exe	86
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87
PID 3080 wrote to memory of 3896	3080	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\10924a7bd7efc02236806ee4e4c70bc4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7fff561b46f8,0x7fff561b4708,0x7fff561b4718
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,10098887247781459716,7558181173553875926,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,10098887247781459716,7558181173553875926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,10098887247781459716,7558181173553875926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10098887247781459716,7558181173553875926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10098887247781459716,7558181173553875926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,10098887247781459716,7558181173553875926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,10098887247781459716,7558181173553875926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10098887247781459716,7558181173553875926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10098887247781459716,7558181173553875926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10098887247781459716,7558181173553875926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10098887247781459716,7558181173553875926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,10098887247781459716,7558181173553875926,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
505B

MD5
98c3312da8b337988830238207f6d79b

SHA1
c775cc312c91c60c51d340e4be2a7fc1e73162f1

SHA256
f1e2c5d3daeeb08c96ad75ad5f07980afba7c54dddbedd41c46f9b5575451a2e

SHA512
82cce05a728202400935f44cbf50288363be6933de78bede53245d970140c1ff689b7c39889506101e2d223d9ecde504c3ba8438db2acfe7d06059afbb947023

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2bbee2ca0446ae0c3c4eb238470401a9

SHA1
7aa6c84033c65808f69f76e11d8c73c7006e9116

SHA256
5544e85a7cb7db895e4b39d7627e8e84c7b6661e385bec2f8750a05dccc1068f

SHA512
e7c7f244c2e9a0a3eb4962a348a75a97f92eb7e7b35f26c53a2f7bf019fc21be775c6b3833f80f6a77c6c81253aa87b0e4bc918430345dd1f3c8cce619e69450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79b4cf5ec692ba894d0a939dfbc72892

SHA1
c35cb85f66bcfc555a27ae24390db08446d7312f

SHA256
c8459acbdc5a1e727b2846a169829b63aa83bd66fdf47b6f2bee00d8173bd793

SHA512
e6f7af7249480534ec63094a5dd4350b2388cf62dd5124e34abd59234c6abc47db7ca688b890781fd8b1f39b2d49455dff5d45607aa22a1be7f492e2ec1e4a11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
73c9feb485db99a8705cecd38c881505

SHA1
a813f345c470d10a03d255a138efc1c9f2739f07

SHA256
4df51ec8bbdfc774839d80a75eff635f6daa11a3596034d7dffaf81d8709d085

SHA512
1c2485f0e2ef7e0be0b26c8184d6e3ae831be0f72c23f68b910a15cc269212587b755d1bd74a33195b610e66d8547ddfbfd9edf10e5aa3b9b2a929a8f37c85d0

Download Submit