7cc01fc6008f20800257b4929f4152a20e8c124c0d7cf6d92d0186601a264cf1

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1573f0d1116a1ab5f377b286e2d23428_JaffaCakes118.html
Size

34KB
MD5

1573f0d1116a1ab5f377b286e2d23428
SHA1

b25802b44c6c028050206870715d2ab7295968ec
SHA256

7cc01fc6008f20800257b4929f4152a20e8c124c0d7cf6d92d0186601a264cf1
SHA512

334477714b0323d477c31a0965aecd02261331481fefece98e3b1f4219b613be2ade9dbbd89f3af19476f12d0952d2627a8ec8c9575aee37149e8cb956049638
SSDEEP

768:F7EpFwSXe6eDewe7eIeygjI1PbCJC3CNChCICrC/CvCPJExBq0Z24HLx8lFWFn:FwpFwSuDqtClpjI5EWmyP84yiJ4q0Z2u

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
2664	msedge.exe
2664	msedge.exe
3296	identity_helper.exe
3296	identity_helper.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 980	2664	msedge.exe	85
PID 2664 wrote to memory of 980	2664	msedge.exe	85
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 896	2664	msedge.exe	86
PID 2664 wrote to memory of 1208	2664	msedge.exe	87
PID 2664 wrote to memory of 1208	2664	msedge.exe	87
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88
PID 2664 wrote to memory of 3748	2664	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1573f0d1116a1ab5f377b286e2d23428_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9650c46f8,0x7ff9650c4708,0x7ff9650c4718
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17090383012028681472,5908520423528988553,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,17090383012028681472,5908520423528988553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,17090383012028681472,5908520423528988553,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17090383012028681472,5908520423528988553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17090383012028681472,5908520423528988553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17090383012028681472,5908520423528988553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1644 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17090383012028681472,5908520423528988553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17090383012028681472,5908520423528988553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17090383012028681472,5908520423528988553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17090383012028681472,5908520423528988553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17090383012028681472,5908520423528988553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17090383012028681472,5908520423528988553,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
308B

MD5
a914aa5fdfdc59c906d1cda8e0a63aa4

SHA1
0f7f2ea454c4e89ea103027e1d55cf7169470a7b

SHA256
31a84e0913c27049a7aa629690ee12fc2b375f96d0187792af3ff00ca3b15504

SHA512
d14c816de93191da82308d58bb9c32900adbf66b05ad6b21c2dcda77645e0655e6e49c7123c551404251ecd7c9376731f682b62b28d649f27cfdd64c1af656c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
67a3e4da125cc2a9cc164c395889a918

SHA1
78a22e4871245bb10fd274000ed6496019879349

SHA256
9c961c4ec08b425a1a1daa5f02b7ddbbbc3afb64e0706967a14b8600c4b050c9

SHA512
9b7fe0682cad24b0902a3414f663fe5d197e3b28f8f6104421e1ac1284c329cf1908f71f7fa7689e687d8a4b0c773f7cd5cd53f221dbb2e3f53ab300cdd2e782

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8473e80c02966fc06ae4d7707cc399ca

SHA1
65dc18e4efcbb6e977b854eada535facae41b61a

SHA256
2589ec534562d4b1476b31dfd113fec558e4b85a5f9fc23a537b00fce66581d9

SHA512
b5bb3d2db8c0ab15ed5e5160b71b6a45ec2e6a861ce3b6ec4aa0b6182023aba701740fba0e11fa91485271a934151951ab2bc73f94096ff6237f3cedf1a85fa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd8cbee7ad51d64fc029b620a0627303

SHA1
65681970d65a0d8b2170b9a1c774392a32e071df

SHA256
0f3945427bf2af5abed8892e7a2a1652f3e2cd2a2d3d99e38ede448cdc906a25

SHA512
82548f98566a64f4ba661488cee696f2459216f1d30cf6092e85b82f7aeda4c4a571e90c6676f6f61d235c1b7260049af1318f282b225b8fc63708c6692b3c2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6d0cc18c713af1270b3fa1d3782ebb76

SHA1
f0abc3abbad0eef6bfdc7ab316dd5c48a08af32b

SHA256
f6eb53429af21f8b359b58d897fdad44e8d4b3b7f805f926864f24bde6403f56

SHA512
2a23a08b23140812014b8f57cea669e3293830cb3a09a56ed5394db4556c497497f0e556c2723da5483e5dea4efae1acbb0bfdf10647f4092ef7145d968510c6

Download Submit