e9d052d6394af000d209ee83e9f4ab8b71f601d3d3686cb7c6eea7364b07d426

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

150bdb35b9b94a12abe569acf3cf7ae9_JaffaCakes118.html
Size

64KB
MD5

150bdb35b9b94a12abe569acf3cf7ae9
SHA1

e0fc1fe3c3481551d810afd61331936252668db8
SHA256

e9d052d6394af000d209ee83e9f4ab8b71f601d3d3686cb7c6eea7364b07d426
SHA512

dbdfd6e7123cebd4272ec33a9bffc21be070824a3e8d4542e43d6c45384d0285fa518723e75d0a149d03fe657f4829e3799b1528a1d5da1efff25fc8c84da621
SSDEEP

1536:gjuSVOd7yhj0KQx689Y/Ex5hGWgmOyCEFa3:HSVC7yhjLQx689HMgs

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe
536	msedge.exe
536	msedge.exe
228	identity_helper.exe
228	identity_helper.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1332	536	msedge.exe	83
PID 536 wrote to memory of 1332	536	msedge.exe	83
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 3112	536	msedge.exe	84
PID 536 wrote to memory of 4696	536	msedge.exe	85
PID 536 wrote to memory of 4696	536	msedge.exe	85
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86
PID 536 wrote to memory of 3808	536	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\150bdb35b9b94a12abe569acf3cf7ae9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80ad846f8,0x7ff80ad84708,0x7ff80ad84718
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6393879650477710214,16113942986519812585,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,6393879650477710214,16113942986519812585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,6393879650477710214,16113942986519812585,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6393879650477710214,16113942986519812585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6393879650477710214,16113942986519812585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6393879650477710214,16113942986519812585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6393879650477710214,16113942986519812585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6393879650477710214,16113942986519812585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6393879650477710214,16113942986519812585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6393879650477710214,16113942986519812585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6393879650477710214,16113942986519812585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6393879650477710214,16113942986519812585,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
22f9ae4330f11e46ae650f5f5cab0af0

SHA1
4c70f68e4b8317f4347d5bf992b8be57bc6304c3

SHA256
86ed00df57e7a4687e707598d028bad604ade12b1d13636d98fff439c2f03e9b

SHA512
ea72af42ba3abb08e180ce3376ad068e0515593fc752eaeff8f7fec52713659683f9d63af4712130270d627826d5dcd7b67eefa02c623dc984c8ce77f6d4b6ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8516e9e143d7c72ffa5816a1da978396

SHA1
05506f24e1c2ec50c1aaf71817291fb20d93374a

SHA256
4f098eb05eba8baeda76458e214bde48a43e4c6e56f58d92ffcad56bea8483fa

SHA512
5f0af812ffe533df0c7df1889e6039c8a1558aec95025d9172f05ef80540e67ae2ef24bf4435f3db704a3b3ef7481956d266e25cd464df394b3fcf020871c267

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
60d81ad589785302808bca6094a407fc

SHA1
8e626f786270bd816c0bca92850b9920f1dd270b

SHA256
6bf3fb5cb4c044b47669e3375f8d8afe8ab789015734b0500fe3b8377b11d38d

SHA512
8c424c9cfbc27a46d13c38bb4e3692975be8b3d7017697a727c00b2417c85ddf8a6881d4fca273ce9b942605a2a3d0bbb6b1c433bac9e475ba7d2b879464dd4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6ec06fe81541c5aae50d311c7b025db3

SHA1
afa922301d9da88bfde744889eed3b5c375803bf

SHA256
9d9a0184b77a2ddf03c07b346c67c1ca2b019cc20ec37479a20756b40c0acbb3

SHA512
136d9a33f5e1b83254be342c2b9e6d0849d6b1a8ee714e2a2300cf3cba4c99512c121d179cba8a4818a68ca5e1a67b6c0c97726c52185155fc9350352c263d09

Download Submit