8d502057536cf009c35c6890858019235eb7ce7b07220e05a16166a1144a8b54

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13563f0e9ba2727f81a6e1f2f05f7b12_JaffaCakes118.html
Size

29KB
MD5

13563f0e9ba2727f81a6e1f2f05f7b12
SHA1

1720b33c0e6ed94117c1c24e513d6a78e9a4f50a
SHA256

8d502057536cf009c35c6890858019235eb7ce7b07220e05a16166a1144a8b54
SHA512

22152d920f29cb537f60ca6906140d6b5eff2894dab2e4164a538863e2c802b3e069b5ad4933fa658ad8d31178a9a9c8bacf9c09f87b2b00bdc045766dd4fb75
SSDEEP

384:4fhkWaw/TJnBBEgeL2oz+4i+4o+m+++Z+1+H+b+p+c+6FAc0FwzH5VLqIpTMVU+W:4fR+o61BeAI00FWCLk8qsykd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
936	msedge.exe
936	msedge.exe
4168	msedge.exe
4168	msedge.exe
3276	identity_helper.exe
3276	identity_helper.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4912	4168	msedge.exe	86
PID 4168 wrote to memory of 4912	4168	msedge.exe	86
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 5056	4168	msedge.exe	87
PID 4168 wrote to memory of 936	4168	msedge.exe	88
PID 4168 wrote to memory of 936	4168	msedge.exe	88
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89
PID 4168 wrote to memory of 1108	4168	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\13563f0e9ba2727f81a6e1f2f05f7b12_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd387a46f8,0x7ffd387a4708,0x7ffd387a4718
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,12619749550138274621,1854102535977508891,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,12619749550138274621,1854102535977508891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,12619749550138274621,1854102535977508891,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12619749550138274621,1854102535977508891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12619749550138274621,1854102535977508891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12619749550138274621,1854102535977508891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,12619749550138274621,1854102535977508891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,12619749550138274621,1854102535977508891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12619749550138274621,1854102535977508891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12619749550138274621,1854102535977508891,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12619749550138274621,1854102535977508891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12619749550138274621,1854102535977508891,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,12619749550138274621,1854102535977508891,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2444 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
fa7fbe7a1731355f526455ceaa7f5b4c

SHA1
18f6e9c34b4d255415df9a6cf7e89c787b97a96d

SHA256
be6da76db3c97eeb60d952b4d9a4bd292c199d029d3ad1d058d2e5320d82699b

SHA512
e98d14f16b0388e839d8b0d69ecd1c565fba974fd1742aa4a57a6755da960d88c7e67ec0964cf75928ea099d69310ee2afc0b915051c795beef9e69b52960441

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f6660a1d468c4ddd38331e877ca99a68

SHA1
3a2d73d68ef40c021e4c732168a3ce5f67167593

SHA256
2d443680d91e8a5056672d4cf8527b60d1b7347c61bd46913272c1004e71cb0e

SHA512
5a756493d0252454871a880f23323b0344311ca3062bda6a89b03cff19808ccfd28f59c19dcce4edd6993c4743e3bc64f26ede5ae21b6b7499f168260d85b73d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f5b3b589065d3d784800c5fd252acc88

SHA1
5a90e3caddb1a0384dbe0da824efb4d5a1ccd019

SHA256
26aae4ad4b50e3fcc454a3a77c71df89af15c3ee02dd0a107afe202c4226cf67

SHA512
52628a3bb004683cf6c5d0862b117bccc3bbe99372fd94f0adb38011b2e4b6bfd75448be372ab08130bf0a87e1cf508dbe62846ec9ec974a9b57229be5641cd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\de2cedf7-6660-45ca-bba2-a06a6bb07a90.tmp

Filesize
1KB

MD5
be34ecdb083713f691bb0a45fe718b14

SHA1
55dc30d020ca3cb8b5ffbd9ae956d136837d9323

SHA256
f04b0b042ccbf909d145927b9d49754ecf6152c7a8ea507c854f00d63ffd92bd

SHA512
c86532d928d4657cc21d698605a9e8231401eb0e71bb7a1b4cd1e81b561753410face1f5fdb2d747e8321d12097cbd36312f273c5be22d6649199fe4d9897eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
63215063a975cd43d37264fff2905c72

SHA1
2932107f7eecb02aba3b95c3669bfc01f52bbf17

SHA256
4d535555b885d458b9efdb85693881fab5ae898f8543599491fd9076651b2239

SHA512
434d573465bef428e93c5147d7e85cb50a6d70ab990f7670ce6b8864344ae91773091eac00516ff6896fc9754f6cb4272a681716823d601ac7a463660d448012

Download Submit