e01b9cf914634f38794a4ce1c19d50524471d365509df28b20abaaf574612c0a

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

133a1f0f881ddb6d4e2ed8c072f17597_JaffaCakes118.html
Size

20KB
MD5

133a1f0f881ddb6d4e2ed8c072f17597
SHA1

6ae0d54f933b57551f00e3025712678d402918e2
SHA256

e01b9cf914634f38794a4ce1c19d50524471d365509df28b20abaaf574612c0a
SHA512

745761eb0f7cec6e8ce67ea0fd19bfd61e7f7741968d8caad971ae59394f8673279f592e2fdd15a5af103fb87231a9997ef60aa67a14ea6cb222bc622dcd094c
SSDEEP

384:3COUGjnXb2cMnhj9qfwPlszlT1yNwMWaYV:pU0nMnhazlTUq

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
2188	msedge.exe
2188	msedge.exe
384	identity_helper.exe
384	identity_helper.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2828	2188	msedge.exe	83
PID 2188 wrote to memory of 2828	2188	msedge.exe	83
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 4984	2188	msedge.exe	84
PID 2188 wrote to memory of 3820	2188	msedge.exe	85
PID 2188 wrote to memory of 3820	2188	msedge.exe	85
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86
PID 2188 wrote to memory of 3332	2188	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\133a1f0f881ddb6d4e2ed8c072f17597_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffdf95b46f8,0x7ffdf95b4708,0x7ffdf95b4718
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12591950543011782188,11632701710390602339,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12591950543011782188,11632701710390602339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,12591950543011782188,11632701710390602339,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12591950543011782188,11632701710390602339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12591950543011782188,11632701710390602339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12591950543011782188,11632701710390602339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12591950543011782188,11632701710390602339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12591950543011782188,11632701710390602339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12591950543011782188,11632701710390602339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12591950543011782188,11632701710390602339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12591950543011782188,11632701710390602339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12591950543011782188,11632701710390602339,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
272B

MD5
56fbca1f3de53eb2283e50ea0f290b2f

SHA1
894803ff0ddefbd71aa5222f0c50b894df47e68c

SHA256
e5a834a7e94554ce6723ace92d94e09c6099d090e98647790a33fe6894d43e41

SHA512
6da1163e260d255a91104d389481bccb03fe7e73c9c7254814ed3306e1e48b4b696a6f455668ec03f2ba3c6de18af6748116c1f9ec96b905786e1dfc9c7f2bb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
99aed3676ebb52cd32e367f2260f7db5

SHA1
fc2b158ea28a02062dcafcce4aa69b496740fb1c

SHA256
7aa070119e311f28e25425f13f1d4503f4390d8ce4f988effb101b31a16063bb

SHA512
194c6d9652ba952622fe53532db2a47b423624cd4ea85188145a2fcba52eaf3e0f2d0a1eadca5108e3fe58db9b9c1558490a8ac29157ca18fe58b850058c7cd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3707297dedefa38d9c0ca44c80057574

SHA1
161542023d31be39c8022e1209044d4d366f76ff

SHA256
11051287996f90eea89ff7e2980b23b01fe9dab41cd5000cbd40247acf2f7264

SHA512
20e6065c30a374a5c1ebb2e8e356ab5bb56cd9c2d5c55500e80222198eee8cc50837b8d488335e63a0adf2b1975d45319bdafa555f2db67a4d3545e807af394e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
050bb8facd908d772eb6dddfc3ac6b19

SHA1
6aac1035b65099c6c34c07f4b4cf890302eb9e18

SHA256
2460d2da6cdb1ba77f9023f3c7aacd82286f60eb844dcfee6acf759d5da0b41c

SHA512
bda24e81e8c5e5f381e7b54ff700dbf0a6d363191108421b06f2511207b433b186c168c25c24a94365a7d0179531eb3c1e76365b0ed972f01462ad916122d1a4

Download Submit