7f5dbfb04855960b2a6c9d861ffe0eb7c4cb319c31cd3287426995f3d4dc35b4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1309ffcdaf3be8e4fb5d33f5454b16fc_JaffaCakes118.html
Size

95KB
MD5

1309ffcdaf3be8e4fb5d33f5454b16fc
SHA1

d2ca9cb2504cffdb49220f976e093cdfa1fffc65
SHA256

7f5dbfb04855960b2a6c9d861ffe0eb7c4cb319c31cd3287426995f3d4dc35b4
SHA512

16483c4e0730b0834b79f10c2cf88947f56609f41536a6dbbc8ba1fd5a19d00b30dae6ba08e3435e9d8702319129dc5ab7dbed00e4562ba1cdc63958d7efcee6
SSDEEP

1536:kpA3St91SpPWVzn98zrN4Z5fu31hPNL4cDQCRSrAC:Ut9GWlWzrN4Z5fu31hPBDpRSrAC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
1652	msedge.exe
1652	msedge.exe
2560	identity_helper.exe
2560	identity_helper.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 988	1652	msedge.exe	84
PID 1652 wrote to memory of 988	1652	msedge.exe	84
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4476	1652	msedge.exe	85
PID 1652 wrote to memory of 4156	1652	msedge.exe	86
PID 1652 wrote to memory of 4156	1652	msedge.exe	86
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87
PID 1652 wrote to memory of 3616	1652	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1309ffcdaf3be8e4fb5d33f5454b16fc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffecdd946f8,0x7ffecdd94708,0x7ffecdd94718
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,12164153748730283548,11266505275710932835,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,12164153748730283548,11266505275710932835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,12164153748730283548,11266505275710932835,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12164153748730283548,11266505275710932835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12164153748730283548,11266505275710932835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12164153748730283548,11266505275710932835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,12164153748730283548,11266505275710932835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,12164153748730283548,11266505275710932835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12164153748730283548,11266505275710932835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12164153748730283548,11266505275710932835,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12164153748730283548,11266505275710932835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12164153748730283548,11266505275710932835,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,12164153748730283548,11266505275710932835,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
51e5018424c485d609585cd84bf05eee

SHA1
3ba33f98e78f707f1308f46e7e215e90c616ddeb

SHA256
3058d8234c64d7cdbc9f1241fad1a3540fbb390da3cf9438f250e331a658f61f

SHA512
0962dfa1d633cc7ba84125aea7787ce6eb9d06fbcb6ce82def7f933190a458bd303b71e611e0e15ddd26d60ddd8b4fd68f4cd6aa5084da11cf75188e12dd18bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9aca62917157360efa04eb4e95cd3903

SHA1
c2ebfcdbe5fb82886df48e59343e114f76fd2b26

SHA256
111c37aa7cadbf9ec7b9a55eb4c4c7dd4f002bcfa84b35b2c88d14ab094ccc54

SHA512
aab7557fa8470a1d9708829bec9089143b137cfd20aa1da523dfdd7427f24910a0c5bc8805b18790ab9535bf4f1ea254ea3867203b03364a7c35a29ad49450bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52162a923d4d4a9f975f554ba81975ba

SHA1
1f2ef80f2ae5302893d637a709453fa73657e1e9

SHA256
9280b337f1acd0e6f1f205fbbe851bc2d65d2b8e154b1f9c21d4877748d014f1

SHA512
f1e288c178fc1b0d03da633956b5ae270c0f2101fcdc6b602e614597cbddbcec9f10b2b6b8ff6e7358411ae9923e726a6499036738969a9f6c823d530194fed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f321b4379821dc9abcdd15c95ea8e765

SHA1
b2c4d85517b8609b217f940aef9f10b6ed63a7e7

SHA256
6625cb7453036ea91967a6d7faf0054cb27835332306b67b4ca1783d41535d3d

SHA512
069e93b98bc5dcfab4ea25ee7d64d08aac006ed9ffd0344c34698f957ae5f0b2f2a2d8366ddef79307c66470662b7ab3fb4acd7ab8e2a2ca80a2bce9f28624e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f29627deab0b820372c5e132f7b971fb

SHA1
9209b06d8ba2b2bcd1aced685e7d0e5730090eb6

SHA256
e2ff133663169441095554afffb3c8088dff26e0678da151f8d849b28141843c

SHA512
366f47d515707338289b4fb70e8831f5c74eb863dfa63b7053ad6bd290a40548f89358a3d271878ad106c15116711fdbb58cee7d81e0190cb41b12e42383f9c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
890f965987d0ec9e36c464afc5a8e0b1

SHA1
46fd72a0a3d9162469747f96cf787fe7aaa55304

SHA256
c9709eb560985f34064f3ea68bb46fd05152225928c58d0b553d96b2297d5f6d

SHA512
35cf514fa6ef359616aa214fc5c82384f49c1f53f6c9e1441def9a027d328a420f373598ccdfedba3b572b7303d420b67abb8f9593302cda1daacf142b599b82

Download Submit