5b591f75aa5a635ca0db116a7ad8820c6ff3fdbcf901f250e1b77f3d4237040f

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11957948292479b954ec7bacec879069_JaffaCakes118.html
Size

4KB
MD5

11957948292479b954ec7bacec879069
SHA1

79df50398f02c90362e2ff43027ffc7f18f7b7cc
SHA256

5b591f75aa5a635ca0db116a7ad8820c6ff3fdbcf901f250e1b77f3d4237040f
SHA512

a6d8affe2c41923ad8f77902a2055d97709730d71bd8f90367acc0863f08c4fafcb89353d78bf5cec6491e4288dc3a8d3e471a3c85056941b0d3f9cf3b33653a
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o+rrw5Kh:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDr

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
1056	msedge.exe
1056	msedge.exe
3508	identity_helper.exe
3508	identity_helper.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 3600	1056	msedge.exe	84
PID 1056 wrote to memory of 3600	1056	msedge.exe	84
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 3704	1056	msedge.exe	85
PID 1056 wrote to memory of 4816	1056	msedge.exe	86
PID 1056 wrote to memory of 4816	1056	msedge.exe	86
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87
PID 1056 wrote to memory of 4024	1056	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\11957948292479b954ec7bacec879069_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca21f46f8,0x7ffca21f4708,0x7ffca21f4718
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,5757371342210322922,9136065886103329297,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,5757371342210322922,9136065886103329297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,5757371342210322922,9136065886103329297,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5757371342210322922,9136065886103329297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5757371342210322922,9136065886103329297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,5757371342210322922,9136065886103329297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,5757371342210322922,9136065886103329297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5757371342210322922,9136065886103329297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5757371342210322922,9136065886103329297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5757371342210322922,9136065886103329297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5757371342210322922,9136065886103329297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,5757371342210322922,9136065886103329297,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
7e1d46426094e271c9b4993b194f1250

SHA1
5f2d6b0d52c01ecfe3bfdc2fc09b18de2635b74d

SHA256
8e7cbab23f0aa323b7c208bb1eb62d0c3984296232cb9f19c4adbd0c61ed4d9a

SHA512
d47b0aa42e60d029588cade8f0dfd2be3471c96591103af709ba60f103066f73e2151703cdd3470df8f0dbec1e9aedc14e699788e25ac81e1dd59d0b5b51a8a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
69e2e09e8bdc1e5a2edac172a6272460

SHA1
b7527a6d3fce8e6a3d1e84bae83d9b75c4cf2c8b

SHA256
84d8a5a80e1ab6cf63ecc097100e5ce1c168417d006f2448f94ab92086c1dc95

SHA512
50db7a6edfb8428a366907c22e0210176de4848fae04135f72c3c6b5e611077b284e2128249f429a767c961b7332fd66b83ac32e83e53f12471dfc27aa4f2f27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3d4b81aa8e50881370e3f23d09675b58

SHA1
952bab1d05ec5e69927d6d901781964604e3cddf

SHA256
5d872d6a84a6c1102470e8e96b57b80b2fbe4433d0cfdcd020aa7c5affa3286a

SHA512
69780bc55819c178c3e0afd2bd2691ca86576ccfa24578d611f09080e356f5ae4c224b38f1bb60c9eef4c0a2784ab0158ac1323dd67ea2b9359476e322217195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0467b2b4f095c37eabad5b0e735f6cbd

SHA1
b975e598d8e2f632b6dda6e1fe1a9fdcdbf3fe31

SHA256
9c468fa01897cbca7586b18791289a90425d9f7a77582378db4a2c1dd0080b75

SHA512
4bb93821de37d7ec07a1da42893a00446be1168d5497654dc0209522b84015142b5c33c7896487662b7c82ed99bc42584b103171445b9caeda40fdf03df2b0f1

Download Submit