596eef050cec06859ef429aa8965bd765d3c600ab4483ba201aacbf3925fedd7

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 08:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11fd2d107ad6a07465712c5576065f85_JaffaCakes118.html
Size

2KB
MD5

11fd2d107ad6a07465712c5576065f85
SHA1

e36114e046cfabe348b5f1dbc0f975ed7bb0fe68
SHA256

596eef050cec06859ef429aa8965bd765d3c600ab4483ba201aacbf3925fedd7
SHA512

08a234d6058bdc1f2900e73871222ab2330cd448e35ff11b85e489eb97f658b2afd5bd0f9e44e75ff5866976607fefb402a8046c8c69dcf044630f162d5c7fd1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
208	msedge.exe
208	msedge.exe
3680	identity_helper.exe
3680	identity_helper.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 5112	208	msedge.exe	83
PID 208 wrote to memory of 5112	208	msedge.exe	83
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 2332	208	msedge.exe	84
PID 208 wrote to memory of 1464	208	msedge.exe	85
PID 208 wrote to memory of 1464	208	msedge.exe	85
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86
PID 208 wrote to memory of 1396	208	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\11fd2d107ad6a07465712c5576065f85_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb8a0046f8,0x7ffb8a004708,0x7ffb8a004718
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3300113199975965492,15897214942042710213,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,3300113199975965492,15897214942042710213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,3300113199975965492,15897214942042710213,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3300113199975965492,15897214942042710213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3300113199975965492,15897214942042710213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3300113199975965492,15897214942042710213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3300113199975965492,15897214942042710213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,3300113199975965492,15897214942042710213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,3300113199975965492,15897214942042710213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3300113199975965492,15897214942042710213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3300113199975965492,15897214942042710213,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3300113199975965492,15897214942042710213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3300113199975965492,15897214942042710213,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3300113199975965492,15897214942042710213,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5476 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
c81cde3696726687ad052c35ee14cea9

SHA1
bc1d8801f9731949af0609bebc4d687d5088383a

SHA256
849ccc1f0ed9b3fde557bc0929ccf947b642a48caea3f925af23a592186c5f7f

SHA512
be2b791fb8bc7e54bb201d569e41525142a28e9d0983f83e15ff102eae1ac9f9efba84b000be67a24e947f040cdb7c03befb5da2f5a122446ff8122b4d9c5de8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
827B

MD5
48e1472f1c217bb4615c2fbad700f973

SHA1
66758e68ff598a15217a2e079e5ee87b5d18ebdf

SHA256
503e61c2d5996d9dafc193f2acd4fbe90911102dcfdb7bc36a213bd71b479429

SHA512
c63ccef7349a1643fdbb858ff119d47eade444f2e92098f29ba93c58c02a929bd6988da078e726c95b65898893f21d5d9225db3171333082b3b579136c95fc1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3fc5b508b0b74ddcae2710f1887f706a

SHA1
334075daa54d154fad170499d8443949e6544012

SHA256
cfa7305f28e5d8de7c6f3e9c5101fa0244d221a37f60e5547e9ab562d865b3ed

SHA512
4e9655945c04252e8d7d7de7273996cbdeab92cdf3a76a7fe1fd3e85b30b25722a3ea8744c50663029ca20538a443ae28ed6b7792d02965b781b89d0da5ffa4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
963adc2ca880bc084a128247ff41f590

SHA1
3593885104aa5bc7f786077c57d7036d04d08f2e

SHA256
907cc7dd4044d8bb9b5ad0c614696f68479d133368182d91f31a01520021cd41

SHA512
eeddbcbe88e792328952c53a50119d6bf5be459efe92cd45ea1f69dd240e070a66908a616bdbf5de62569aeee1b7426a8e466f583e1013db71439228e58c6060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cd359d7c5f8d54185d8dfcfa6053f934

SHA1
f24ccc58893726ec856333494ed575498c4b3991

SHA256
c82d5ed50495be0084a5656df74c40edc1f19b3568f4e7817b73cd75e1633455

SHA512
b92a411b8d43573d40dc62018c22e8e4bdf51501e5205b75ffdf74434c0d98aa553db45ecd744e1a4bdf894e7b8ff3d410129f1bf123f5309a92ab60d9f89778

Download Submit