e3189cdc816f3d354ae152e1d33032a302d5d27907d8c1b35437c74475584996

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13b526f60f163aea9291ceea84f39937_JaffaCakes118.html
Size

460KB
MD5

13b526f60f163aea9291ceea84f39937
SHA1

ad9091435774431e1ea2176a1ee6332a14ac9f75
SHA256

e3189cdc816f3d354ae152e1d33032a302d5d27907d8c1b35437c74475584996
SHA512

2d39fb92fd6d2a17d3b6b3ee90e69b0e195f0ec4f9c0d8f6746cecd5293f5e32231967ec2b29e94e4f4d51b42ef049134f44e65863d663ee45c529349adc6502
SSDEEP

6144:SgsMYod+X3oI+YlsMYod+X3oI+YSsMYod+X3oI+YLsMYod+X3oI+YQ:t5d+X3L5d+X365d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
3740	msedge.exe
3740	msedge.exe
1496	identity_helper.exe
1496	identity_helper.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 3552	3740	msedge.exe	83
PID 3740 wrote to memory of 3552	3740	msedge.exe	83
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 2112	3740	msedge.exe	84
PID 3740 wrote to memory of 5104	3740	msedge.exe	85
PID 3740 wrote to memory of 5104	3740	msedge.exe	85
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86
PID 3740 wrote to memory of 4648	3740	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\13b526f60f163aea9291ceea84f39937_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce95446f8,0x7ffce9544708,0x7ffce9544718
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6189957100654114796,15082106462211858801,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,6189957100654114796,15082106462211858801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,6189957100654114796,15082106462211858801,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6189957100654114796,15082106462211858801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6189957100654114796,15082106462211858801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6189957100654114796,15082106462211858801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6189957100654114796,15082106462211858801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6189957100654114796,15082106462211858801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6189957100654114796,15082106462211858801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6189957100654114796,15082106462211858801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6189957100654114796,15082106462211858801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6189957100654114796,15082106462211858801,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8aab92d149d62b2f373fd48830001b4d

SHA1
f97d1a0624360d5ab5016b898315a023cc4b8dcb

SHA256
5f4a32e8b0f5eb6e5406d9dda4175cbe31ce07b0be33726575d5fd55f1d112ea

SHA512
41d48f236d51cb713fdabeda91eeb0ac727bffd782e667b828c0daf8554f307422984981adb87995811a817a8edb8024f19ffa13022d9472ab583435cda62998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2474f7069a6a47d31b07675ebff725eb

SHA1
5db52d924e20008bb32f74a9f482da4571cd148d

SHA256
4a3129236fad222fcb44b5af482eb4fad494c648a9ebb34c2f65b80b46410ab6

SHA512
79cdfc9f1590a7bcdf8c8a00f78872ca75fd2966949ccd2f62dce3474e7f0a6c4f8135be2d02f470d1730b487ddc041c164ddf9ac4da0a4445a952e3a740196e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
05106c07f65631b81d80c9b9252e6157

SHA1
edab079bd3c75bf94e6e71e86a053086152e9dfd

SHA256
fdf6902f01502f8c1c7805ee8df6cfa438ccd4d2d533e4eede24641edf0cc505

SHA512
2db917cdf672199774bae8b560c52c6be030cc1c2b658ea43769a30a9fb534ab1db8f9c1b0a4f021ec37dd6747a4ccc2a94c654ad95be79763889f7efec3b3ea

Download Submit