9cea0812049b97e23e1090c6c42b3fc26542f8964f9e219e6ae9ebcbef37e5d5

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

108600ceeaef9633a0a376eebfb9eae3_JaffaCakes118.html
Size

36KB
MD5

108600ceeaef9633a0a376eebfb9eae3
SHA1

1211718c09335dcbae0b4aed992e8d5d5819a992
SHA256

9cea0812049b97e23e1090c6c42b3fc26542f8964f9e219e6ae9ebcbef37e5d5
SHA512

5ec7f84ff9c6ae797ae93c0c0923ff9632cb0a6ef1a474333d68bb4fe2735634e144eb7b1954987accd655f83c17da734d0b7e713ee23def2d959c4dbc424993
SSDEEP

768:Duc6IhLVKpBdfkxiYBTx4/v0//v3QAveUvf22vLlWvEMMvxMvi0nuPvHwvpmPXkG:/BKpBdfkxiY1a/v0Hv3rveUvfLvLAvEp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
3044	msedge.exe
3044	msedge.exe
4196	identity_helper.exe
4196	identity_helper.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 3640	3044	msedge.exe	84
PID 3044 wrote to memory of 3640	3044	msedge.exe	84
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 3080	3044	msedge.exe	85
PID 3044 wrote to memory of 4456	3044	msedge.exe	86
PID 3044 wrote to memory of 4456	3044	msedge.exe	86
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87
PID 3044 wrote to memory of 868	3044	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\108600ceeaef9633a0a376eebfb9eae3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6f5046f8,0x7ffa6f504708,0x7ffa6f504718
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,14263933358772635485,14259416288602302369,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,14263933358772635485,14259416288602302369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,14263933358772635485,14259416288602302369,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14263933358772635485,14259416288602302369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14263933358772635485,14259416288602302369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14263933358772635485,14259416288602302369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14263933358772635485,14259416288602302369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,14263933358772635485,14259416288602302369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,14263933358772635485,14259416288602302369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14263933358772635485,14259416288602302369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14263933358772635485,14259416288602302369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,14263933358772635485,14259416288602302369,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
565B

MD5
f1f76f75284115d8a9f777295ac92d7e

SHA1
d2a1956a938ff4443344a35ce14686d2a566a445

SHA256
96a94e0b61b1dceb7a89b88fb0eed41c5404dd308c3a6af0173ad2eb02e35cf1

SHA512
0ca1517012ef48be34e4d886db324db663b28a9d28321f35126c36285ef67d2e4a028351c563ead77a3006608201c7bc4bb37f44f11ddd03add672c26786b2d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b9774287a6a0e9f81c9cd50fa85f8ed6

SHA1
8328fc76462519e2c5fa3f69ca4d7c6550bb37a8

SHA256
4dd24c424924ab7be025a25d50ecf1864fa8ea29e6e29fe4879829eeb45938fa

SHA512
7a000c70466e3f19e71e41a0435da8a6c4cc71fc8678303401b263d0557a17a4a36eabb881fb53cbd657709b36084ec9398a5c9e964f8022d98448d4e02afb51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3ffd8234fbd3f3e5e884cc4b1cb32aa

SHA1
58a53004adff43523bbb84cdcd4a85fefaa6664d

SHA256
874ad61bf9ad91b20ae8f36e701e924a22f4dc294555d711e4473addf1c90b6a

SHA512
bd3b0e073e5793f33f3a3b965d3f010bff014da90d65d2af44aa439aee910a9592581098faf2e82633a554f8f0fa830861cf98b1a39a0ccc3827060517d93dbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1ccb73a7ec39c36690f02514c8516c19

SHA1
811bbb8d10713e54365bffe932a45550bcb4f582

SHA256
46a43f62be861ba29997bd7656c6b4789c237c0b684581bfa8f27d0e4df04019

SHA512
2a9a358c3f5ca61832b832bfe105f044828b60c6317733f3871b34f6731c2dc50fe7a4cefaebaf8423913daf8e804c30f91d2ba456b72db4da86956fb7a28c39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f55a14656020a42b7b2f7d3ff2a236d2

SHA1
349f7fffe42cdeb3f6676b000247bea5e7e15142

SHA256
99dded21dc12080f2f486b386d985d5ac28d13018d18ff058417f09c55dfbe41

SHA512
b1af4b1efc6e4e2307aa3f3fd54fc943453702a3d176782e40d3b351e6c747bb5e0936b3d70d486897b9806f6dbb0a2572cf68457a47d654520704b2d1125084

Download Submit