27bff356acf8d3895c647de78060e73edf3d42bd3ff86925161cfe01a854f78e

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 08:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11eae7ffbb198380cc520e472201e641_JaffaCakes118.html
Size

49KB
MD5

11eae7ffbb198380cc520e472201e641
SHA1

da55b86425dfb2517f74a5eee9938b41625c1728
SHA256

27bff356acf8d3895c647de78060e73edf3d42bd3ff86925161cfe01a854f78e
SHA512

4629ac9b5a89483a72b6a1b13f8c16ea0b4dd96cfd99cd78297ee9c3ecc57c6e9314c9e5b470336157ad42bff4dbecc9cda441efd7e997a7db18fa047b216d63
SSDEEP

384:PhtWIAngeQcWhG+97pxCcqglpvWCenZrQyv2DHQDk9mMIb/pwm01gBQ6X6O5PfDv:PageQJhG472cbldWCeaDdY126

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
3496	msedge.exe
3496	msedge.exe
4652	identity_helper.exe
4652	identity_helper.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 4840	3496	msedge.exe	85
PID 3496 wrote to memory of 4840	3496	msedge.exe	85
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 4672	3496	msedge.exe	86
PID 3496 wrote to memory of 1136	3496	msedge.exe	87
PID 3496 wrote to memory of 1136	3496	msedge.exe	87
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88
PID 3496 wrote to memory of 5100	3496	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\11eae7ffbb198380cc520e472201e641_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff36c46f8,0x7ffff36c4708,0x7ffff36c4718
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,15668958836496366021,3546161789495018217,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,15668958836496366021,3546161789495018217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,15668958836496366021,3546161789495018217,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15668958836496366021,3546161789495018217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15668958836496366021,3546161789495018217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,15668958836496366021,3546161789495018217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,15668958836496366021,3546161789495018217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15668958836496366021,3546161789495018217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15668958836496366021,3546161789495018217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15668958836496366021,3546161789495018217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15668958836496366021,3546161789495018217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,15668958836496366021,3546161789495018217,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
309B

MD5
0707a29b8e5587391a92c1744c3635c9

SHA1
bb2c1e3b0e1a4186ea68676e338fa7a976f01a74

SHA256
85f92ee6e54dcc52aa31b4b70ae2c4ade0bae9eed1906c6cc888227c7ec62054

SHA512
4b8b65f6e778ed83a9a9502a5b656f1e2bbae4d4f286f736239e7f88db487dc32cbbedf34aeea51a8593654e1cdc9b590e368cef869b118f898bbce0c07cb2c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c755b289394ad2dcc5ce9eb273a72438

SHA1
2de092a6ff80f2b3595cce1a13567e1a7c812b9d

SHA256
f8bc5290db18998fe037e5343835a3b8920cf14eba6d7908690e3b6b9f7877d9

SHA512
546e843210a649da5c7f4dff71cd43e1c40ad50c0e8cb7e826dfc29a0b97d9273be5602cb0a90e852f13726f84e79a5a7b0bb10d00c3cf20ae63c19001cd041a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e05b1a2c-3dea-43da-87bc-f80c72beadb9.tmp

Filesize
5KB

MD5
68d3b4260cb8a7ac5b9ed76b505728ee

SHA1
5d7566415f3ddd447ccd3c209bc730787fcb79ff

SHA256
cf434539f9e2e2b09763370f19073a816211489a3feb73878116408aba425784

SHA512
8938390dd98d090aeb55839de6d757d85cf003a28796f744c84aaa2d3c8d9d099e3db1895a84312fae0e072d6442bad01848f5524ed7b968dd473f13d7e502ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a8f2f7a15d90c5b0853989bccacd3c93

SHA1
2b8a151d264c145e19c65e61ad5529548d46dbce

SHA256
417da5d77e26a96389adca92faac05f5b5db1b723728cf8d12fecb3077e365c3

SHA512
76c6618cfe0ab74fb840f00b3ed9dd71e40e9488b549ffab151d2ee5648895422f04c5237e6c29b9b246539f0eea28edc54d1825b0f5cf6c2b9f75ffa02cddfc

Download Submit