bc06fcfb5a08a58a8e64beffd27ecf7c16b481c4af6fac95773fe1c3a28fca3b

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13c1aed97059624be853a09df47e8712_JaffaCakes118.html
Size

127KB
MD5

13c1aed97059624be853a09df47e8712
SHA1

0b40f105600d66c0c59c7237d3869a2ba52499d3
SHA256

bc06fcfb5a08a58a8e64beffd27ecf7c16b481c4af6fac95773fe1c3a28fca3b
SHA512

073d6f837c14a0f884eaa09f3e1a404a86ec0809f90690475a17f6ee1c61a4221895514c909e2009e1f6b5f0c462be23b18daf0ebfef4b5870d26bf36e605055
SSDEEP

3072:TB+g1FkEWp7kMmVG1VcVBizWutbJgn3gUABkMpC6PLzlu:B2EWp7kMmVG1VcVBOWKbJnu

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe
1524	msedge.exe
1524	msedge.exe
4536	identity_helper.exe
4536	identity_helper.exe
5668	msedge.exe
5668	msedge.exe
5668	msedge.exe
5668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 1748	1524	msedge.exe	85
PID 1524 wrote to memory of 1748	1524	msedge.exe	85
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 5032	1524	msedge.exe	86
PID 1524 wrote to memory of 4028	1524	msedge.exe	87
PID 1524 wrote to memory of 4028	1524	msedge.exe	87
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88
PID 1524 wrote to memory of 5324	1524	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\13c1aed97059624be853a09df47e8712_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1f8c46f8,0x7ffa1f8c4708,0x7ffa1f8c4718
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4090183189155869528,5621124507013705721,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,4090183189155869528,5621124507013705721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,4090183189155869528,5621124507013705721,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4090183189155869528,5621124507013705721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4090183189155869528,5621124507013705721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4090183189155869528,5621124507013705721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4090183189155869528,5621124507013705721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4090183189155869528,5621124507013705721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4090183189155869528,5621124507013705721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4090183189155869528,5621124507013705721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4090183189155869528,5621124507013705721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4090183189155869528,5621124507013705721,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
542B

MD5
9d02f9badb8e1614f29c1dc017a4e1f9

SHA1
5b35ddce993e55faab2c28031fc704f708b49971

SHA256
afffecb71cffdfb22e6415ad89eac7518d6b1651cb4ab7ca3ffabd173330e339

SHA512
09f497f205b053546fa8c5ebca2bc873c66b651e18d66442547b4d7a76afd53ee78b370be690740881204f699d94754774012d70af03aa1230af23c2a7cd4cec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0368277182a0299936bd5ee08eaf5a57

SHA1
f68f5f35443c7ed4df688a70245c8fd89a647015

SHA256
5a1002123cb667a9b5c7babfe6ceb84b1d6a95809b2cd1ebc2a966905fc31c6e

SHA512
5d6ea6b49e86520cde06630b9507c2631f18ea3562a3ea928077051cb54961dc37374180b2c35a3c8c7beb46851f48f7825f964eda93f589073161d95618f883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3fe7b04bc7187f3acc5aed97bc04e2d

SHA1
bdb4a1823b5bd3924ff0ad34f60825f2cafb86a2

SHA256
dbe734255fef4ec66e994684a483613b5e0ab8b4b2e95b153fa22141e4b8e7d1

SHA512
f1ac9ab5afd65a8d1784c08eac4d6f72ceb8231c01363d5262a1db1ce3a28403d9d66c3b5d987b5a8b8b284063af8493fb64252c6ea34713aceb0590dfdf93ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b81ee894923194389d6f8df18208ff7d

SHA1
566c0a9ffc0a8fb418aa363491fd097b6431682f

SHA256
72c939d97f12615d555130cab344d055387bb42053417d5c265b73e3f98ccfe2

SHA512
fa08cf5e92a66d46f68b8e3284b626ef696a8e3baeac6e9ee81e5952e97a1d161ad00ee0b409987aa84b077edc273ec02e9974a32601b9b484fbf729bcb4285b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
c15bf6e562c2dcd97c43a6dd7b539bec

SHA1
1e29597e8dca037605c745a5783e8590a3fefb92

SHA256
ab6037204e1f597ff4877814a26710ac7a6ec41c50c23889991673c46bfe1cce

SHA512
6ee36afb4469ca83919d038559db8b07f09950268e8d9860c8b8b6854d47966d6af2e0d1bb953fcb3a9bfff6a2d6f7374bf10263ce19743a45347e12479695b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586368.TMP

Filesize
706B

MD5
71da4d82bc755a9bba1de44b22616bce

SHA1
a39205759d18118bc5707ad78cee0d49c4ab7fc2

SHA256
7ce2cf127458f0e0737a04ff91e678f99b1a28e1249561efe9051c985d75f548

SHA512
a43578d05b0b639b4c8af712f39c7b29c319e7b74975a04054ad117264ff846d93eadebbe4d4869a9e65165eebe5022ac9584187f6133836fff57fd6d1005885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c8ec5183748c603f1f86a156412408b8

SHA1
8e8931d6793b3f064b776f59eccbfb7d00bab0a9

SHA256
3d710cbd5b6d46500e1c11a3af88ed0137d4263755a50e7171545ecd77d992da

SHA512
48ca83b0b12bd6ac157a247709a2802e74ee45f43ff36ba31bcf636b204962fe4da473e9495b077c8b6b89bf4b04d97b3b904b2d2b82b60007873ae4814a53bc

Download Submit